@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Server/API/NotificationChannelVerificationAPI.test.ts

@@ -3,6 +3,11 @@ import UserEmailAPI from "../../../Server/API/UserEmailAPI";
 import UserIncomingCallNumberAPI from "../../../Server/API/UserIncomingCallNumberAPI";
 import UserSmsAPI from "../../../Server/API/UserSmsAPI";
 import UserWhatsAppAPI from "../../../Server/API/UserWhatsAppAPI";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+  VerificationCodeRateLimitOutcome,
+} from "../../../Server/Middleware/VerificationCodeRateLimit";
 import UserCallService from "../../../Server/Services/UserCallService";
 import UserEmailService from "../../../Server/Services/UserEmailService";
 import UserIncomingCallNumberService from "../../../Server/Services/UserIncomingCallNumberService";
@@ -22,6 +27,9 @@ import {
 import Response from "../../../Server/Utils/Response";
 import { mockRouter } from "./Helpers";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import JSONWebTokenData from "../../../Types/JsonWebTokenData";
 import ObjectID from "../../../Types/ObjectID";
 import { beforeEach, describe, expect, it } from "@jest/globals";
@@ -517,27 +525,122 @@ describe.each(CHANNELS)("$name verification routes", (channel: Channel) => {
    * is asserted directly.
    */
   describe("rate limiting", () => {
+    /*
+     * The limiter each route was built with, by bucket, captured while the API
+     * class registers its routes. getMiddleware returns a fresh closure per
+     * call, so this is the only way to name "the limiter" by identity rather
+     * than by position.
+     */
+    let limiters: Map<VerificationCodeRateLimitBucket, unknown>;
+
+    beforeEach(() => {
+      limiters = new Map<VerificationCodeRateLimitBucket, unknown>();
+
+      const realGetMiddleware: typeof VerificationCodeRateLimit.getMiddleware =
+        VerificationCodeRateLimit.getMiddleware.bind(VerificationCodeRateLimit);
+
+      const capture: jest.SpyInstance = jest
+        .spyOn(VerificationCodeRateLimit, "getMiddleware")
+        .mockImplementation(((bucket: VerificationCodeRateLimitBucket) => {
+          const limiter: ReturnType<
+            typeof VerificationCodeRateLimit.getMiddleware
+          > = realGetMiddleware(bucket);
+          limiters.set(bucket, limiter);
+          return limiter;
+        }) as never);
+
+      mockRouter.routes.length = 0;
+      channel.build();
+
+      capture.mockRestore();
+    });
+
     it("registers a limiter in front of the verify handler", () => {
       expect(
-        mockRouter.match("post", channel.verifyPath).middlewares.length,
-      ).toBeGreaterThanOrEqual(2);
+        mockRouter.match("post", channel.verifyPath).middlewares,
+      ).toContain(limiters.get(VerificationCodeRateLimitBucket.Verify));
     });
 
     it("registers a limiter in front of the resend handler", () => {
       expect(
-        mockRouter.match("post", channel.resendPath).middlewares.length,
-      ).toBeGreaterThanOrEqual(2);
+        mockRouter.match("post", channel.resendPath).middlewares,
+      ).toContain(limiters.get(VerificationCodeRateLimitBucket.Resend));
     });
 
-    it("runs the limiter after user authorization, so it can key on the user", () => {
-      const middlewares: Array<unknown> = mockRouter.match(
-        "post",
-        channel.verifyPath,
-      ).middlewares;
+    /*
+     * The limiter keys on the user, so it has to run after the session is
+     * resolved. It also has to run after the session is REQUIRED: an expired
+     * session arrives here as an anonymous request (the access-token cookie
+     * expires with the token), and if the limiter ran first that request
+     * would spend the item and IP budgets before being refused - and be
+     * refused with a 429 or a handler 400, neither of which makes the browser
+     * client refresh the session. requireUserAuthentication answers it with a
+     * 401 first, so the budget is only ever spent by a known caller.
+     */
+    it.each([
+      ["verify", VerificationCodeRateLimitBucket.Verify],
+      ["resend", VerificationCodeRateLimitBucket.Resend],
+    ])(
+      "runs the %s limiter after user authorization and the authentication guard",
+      (_label: string, bucket: VerificationCodeRateLimitBucket) => {
+        const path: string =
+          bucket === VerificationCodeRateLimitBucket.Verify
+            ? channel.verifyPath
+            : channel.resendPath;
+
+        const middlewares: Array<unknown> = mockRouter.match(
+          "post",
+          path,
+        ).middlewares;
+
+        expect(limiters.get(bucket)).toBeDefined();
+        expect(middlewares).toHaveLength(3);
+        expect(middlewares[0]).toBe(UserMiddleware.getUserMiddleware);
+        expect(middlewares[1]).toBe(UserMiddleware.requireUserAuthentication);
+        expect(middlewares[2]).toBe(limiters.get(bucket));
+      },
+    );
+
+    it("never spends verification budget on a request with no session", async () => {
+      const consume: jest.SpyInstance = jest
+        .spyOn(VerificationCodeRateLimit, "consume")
+        .mockResolvedValue({
+          outcome: VerificationCodeRateLimitOutcome.Allowed,
+        } as never);
+
+      const anonymous: OneUptimeRequest = {
+        body: { itemId: ITEM_ID, code: CORRECT_CODE },
+        headers: {},
+      } as unknown as OneUptimeRequest;
+
+      const middlewares: ReturnType<typeof mockRouter.match>["middlewares"] =
+        mockRouter.match("post", channel.verifyPath).middlewares;
+
+      // Everything after getUserMiddleware, in order, stopping at a refusal.
+      for (let index: number = 1; index < middlewares.length; index++) {
+        const next: jest.Mock = jest.fn();
+
+        await middlewares[index]!(
+          anonymous,
+          mockResponse,
+          next as unknown as NextFunction,
+        );
+
+        if (next.mock.calls.length === 0) {
+          break;
+        }
+      }
+
+      expect(consume).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalledTimes(1);
+
+      const error: Exception = (
+        Response.sendErrorResponse as unknown as jest.Mock
+      ).mock.calls[0]![2] as Exception;
 
-      /* UserMiddleware.getUserMiddleware is registered first. */
-      expect(middlewares[0]).not.toBe(middlewares[1]);
-      expect(typeof middlewares[1]).toBe("function");
+      expect(error).toBeInstanceOf(NotAuthenticatedException);
+      expect(error.code).toBe(ExceptionCode.NotAuthenticatedException);
+      expect(store.current?.verificationFailedAttempts).toBe(0);
     });
   });
 });

package/Tests/Server/API/OnCallCalendarAPI.test.ts

@@ -271,6 +271,8 @@ import OnCallCalendarFeedRateLimit, {
 import OnCallDutyPolicyScheduleCalendarFeedService from "../../../Server/Services/OnCallDutyPolicyScheduleCalendarFeedService";
 import ProjectOnCallCalendarFeedService from "../../../Server/Services/ProjectOnCallCalendarFeedService";
 import UserOnCallCalendarFeedService from "../../../Server/Services/UserOnCallCalendarFeedService";
+import SelectPermission from "../../../Server/Types/Database/Permissions/SelectPermission";
+import Select from "../../../Server/Types/Database/Select";
 import {
   ExpressRequest,
   ExpressResponse,
@@ -294,6 +296,9 @@ import OnCallCalendarFeedUrls, {
   PROTOCOL_WARNING,
 } from "../../../Server/Utils/OnCall/OnCallCalendarFeedUrls";
 import Response from "../../../Server/Utils/Response";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import OnCallDutyPolicyScheduleCalendarFeed from "../../../Models/DatabaseModels/OnCallDutyPolicyScheduleCalendarFeed";
+import ProjectOnCallCalendarFeed from "../../../Models/DatabaseModels/ProjectOnCallCalendarFeed";
 import Protocol from "../../../Types/API/Protocol";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import OneUptimeDate from "../../../Types/Date";
@@ -318,6 +323,7 @@ import Permission, {
   UserPermission,
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
 import {
   DASHBOARD_URL,
   at,
@@ -366,9 +372,7 @@ interface HttpResult {
 interface CapturedFindOneBy {
   query: Record<string, unknown>;
   select?: Record<string, unknown> | undefined;
-  props?:
-    | { isRoot?: boolean | undefined; ignoreHooks?: boolean | undefined }
-    | undefined;
+  props?: DatabaseCommonInteractionProps | undefined;
 }
 
 interface CapturedUpdate {
@@ -458,11 +462,13 @@ function routeFor(method: string, uri: string): RegisteredRoute {
 function buildMemberProps(data: {
   projectId: ObjectID | undefined;
   userId: ObjectID | undefined;
+  permission?: Permission | undefined;
 }): DatabaseCommonInteractionProps {
   const memberPermission: UserPermission = {
     _type: "UserPermission",
-    permission: Permission.ProjectMember,
+    permission: data.permission ?? Permission.ProjectMember,
     labelIds: [],
+    isBlockPermission: false,
   };
 
   const permissionMap: Dictionary<UserTenantAccessPermission> = {};
@@ -3386,7 +3392,13 @@ describe("GET /on-call-calendar/feed/current", () => {
     expect(personalFindOneBy).not.toHaveBeenCalled();
   });
 
-  test("an anonymous caller (no user) is refused", async () => {
+  /*
+   * Tightened from "any 4xx" to the exact 401. A caller with no user and no
+   * key is, in practice, a dashboard tab whose access-token cookie expired;
+   * the browser client refreshes the session and replays only on a 401, so
+   * any other status leaves the user looking at an error on their own feed.
+   */
+  test("an anonymous caller (no user) is refused with 401", async () => {
     propsSpy.mockResolvedValue(
       buildMemberProps({ projectId, userId: undefined }),
     );
@@ -3395,7 +3407,43 @@ describe("GET /on-call-calendar/feed/current", () => {
       `${API_PREFIX}${FEED_CURRENT_ROUTE}`,
     );
 
-    expect(result.status).toBeGreaterThanOrEqual(400);
+    expect(result.status).toBe(ExceptionCode.NotAuthenticatedException);
+    expect(result.status).toBe(401);
+    expect(json(result)["message"]).toBe(
+      CommonAPI.AUTHENTICATION_REQUIRED_MESSAGE,
+    );
+    expect(personalFindOneBy).not.toHaveBeenCalled();
+  });
+
+  test("an anonymous caller with no tenant header is the 401, not the missing-tenant 400", async () => {
+    propsSpy.mockResolvedValue(
+      buildMemberProps({ projectId: undefined, userId: undefined }),
+    );
+
+    const result: HttpResult = await request(
+      `${API_PREFIX}${FEED_CURRENT_ROUTE}`,
+    );
+
+    expect(result.status).toBe(ExceptionCode.NotAuthenticatedException);
+    expect(personalFindOneBy).not.toHaveBeenCalled();
+  });
+
+  test("a project API key is authenticated but is nobody, so it gets 422 rather than a 401", async () => {
+    /*
+     * A personal feed belongs to a person. The key fails the member guard
+     * (no userId) before requireUserId is reached, and the answer is the 422 -
+     * a 401 would send an API client off to refresh a session it never had.
+     */
+    propsSpy.mockResolvedValue({
+      ...buildMemberProps({ projectId, userId: undefined }),
+      userType: UserType.API,
+    });
+
+    const result: HttpResult = await request(
+      `${API_PREFIX}${FEED_CURRENT_ROUTE}`,
+    );
+
+    expect(result.status).toBe(ExceptionCode.NotAuthorizedException);
     expect(personalFindOneBy).not.toHaveBeenCalled();
   });
 });
@@ -3427,6 +3475,41 @@ describe("POST /on-call-calendar/feed/rotate", () => {
     expect(result.status).toBe(415);
   });
 
+  test("an anonymous JSON POST is 401 and mints nothing", async () => {
+    /*
+     * The rotate button on a page left open past the access-token lifetime.
+     * The 401 is what makes the dashboard refresh and replay the POST; the
+     * guard runs before the lock, so nothing is minted for the refused call.
+     */
+    propsSpy.mockResolvedValue(
+      buildMemberProps({ projectId, userId: undefined }),
+    );
+
+    const result: HttpResult = await postJson(
+      `${API_PREFIX}${FEED_ROTATE_ROUTE}`,
+    );
+
+    expect(result.status).toBe(ExceptionCode.NotAuthenticatedException);
+    expect(personalCreateForUser).not.toHaveBeenCalled();
+    expect(personalRotate).not.toHaveBeenCalled();
+    expect(semaphoreLock).not.toHaveBeenCalled();
+  });
+
+  test("a project API key POST is 422 and mints nothing", async () => {
+    propsSpy.mockResolvedValue({
+      ...buildMemberProps({ projectId, userId: undefined }),
+      userType: UserType.API,
+    });
+
+    const result: HttpResult = await postJson(
+      `${API_PREFIX}${FEED_ROTATE_ROUTE}`,
+    );
+
+    expect(result.status).toBe(ExceptionCode.NotAuthorizedException);
+    expect(personalCreateForUser).not.toHaveBeenCalled();
+    expect(personalRotate).not.toHaveBeenCalled();
+  });
+
   test("first time: mints the row as root under the (project, user) lock, purges, and returns the plaintext once", async () => {
     const token: string = CalendarFeedToken.mint();
     let created: FeedRowFixture | null = null;
@@ -4232,6 +4315,237 @@ describe("project-feed session routes", () => {
   });
 });
 
+/*
+ * Regression: these routes selected previousTokenExpiresAt as a caller even
+ * though the column denied every reader. Returning fixture rows from a
+ * mocked service hid the failure, including on an unpublished feed. Keep the
+ * HTTP routes real and enforce the model's actual column permissions on the
+ * exact select each route sends before the in-memory lookup runs.
+ */
+describe.each([
+  OnCallCalendarFeedKind.Schedule,
+  OnCallCalendarFeedKind.Project,
+])(
+  "%s status routes with real select permissions",
+  (kind: OnCallCalendarFeedKind) => {
+    let scheduleId: ObjectID;
+    let rows: Array<FeedRowFixture>;
+    let token: string;
+    let find: jest.SpyInstance;
+    let findToken: jest.SpyInstance;
+    let create: jest.SpyInstance;
+    let update: jest.SpyInstance;
+    let rotate: jest.SpyInstance;
+
+    function route(action: "current" | "publish" | "rotate"): string {
+      const routes: Record<typeof action, string> =
+        kind === OnCallCalendarFeedKind.Schedule
+          ? {
+              current: SCHEDULE_FEED_CURRENT_ROUTE,
+              publish: SCHEDULE_FEED_PUBLISH_ROUTE,
+              rotate: SCHEDULE_FEED_ROTATE_ROUTE,
+            }
+          : {
+              current: PROJECT_FEED_CURRENT_ROUTE,
+              publish: PROJECT_FEED_PUBLISH_ROUTE,
+              rotate: PROJECT_FEED_ROTATE_ROUTE,
+            };
+
+      return `${API_PREFIX}${routes[action].replace(":scheduleId", scheduleId.toString())}`;
+    }
+
+    function addFeed(previousTokenExpiresAt?: Date): FeedRowFixture {
+      const makeRow: typeof scheduleRow =
+        kind === OnCallCalendarFeedKind.Schedule ? scheduleRow : projectRow;
+      const row: FeedRowFixture = makeRow({
+        projectId,
+        onCallDutyPolicyScheduleId: scheduleId,
+        tokenHash: CalendarFeedToken.hash(token),
+        previousTokenExpiresAt,
+      });
+
+      rows.push(row);
+      return row;
+    }
+
+    beforeEach(() => {
+      scheduleId = ObjectID.generate();
+      rows = [];
+      token = CalendarFeedToken.mint();
+
+      const isSchedule: boolean = kind === OnCallCalendarFeedKind.Schedule;
+      const modelType:
+        | typeof OnCallDutyPolicyScheduleCalendarFeed
+        | typeof ProjectOnCallCalendarFeed = isSchedule
+        ? OnCallDutyPolicyScheduleCalendarFeed
+        : ProjectOnCallCalendarFeed;
+
+      find = isSchedule ? scheduleFindOneBy : projectFindOneBy;
+      findToken = isSchedule ? scheduleFindOneById : projectFindOneById;
+      create = isSchedule ? scheduleCreate : projectCreate;
+      update = isSchedule ? scheduleUpdateOneBy : projectUpdateOneBy;
+      rotate = isSchedule ? scheduleRotate : projectRotate;
+
+      find.mockImplementation(async (args: CapturedFindOneBy) => {
+        expect(args.props?.isRoot).not.toBe(true);
+        SelectPermission.checkSelectPermission(
+          modelType,
+          args.select as Select<BaseModel>,
+          args.props || {},
+        );
+
+        return await lookupFrom(rows)(args);
+      });
+      findToken.mockImplementation(async (args: { id: ObjectID }) => {
+        const row: FeedRowFixture | undefined = rows.find(
+          (candidate: FeedRowFixture) => {
+            return candidate.id.toString() === args.id.toString();
+          },
+        );
+
+        return row ? { id: row.id, token, tokenHash: row.tokenHash } : null;
+      });
+    });
+
+    test("a viewer can read an unpublished feed without a column permission error", async () => {
+      propsSpy.mockResolvedValue(
+        buildMemberProps({ projectId, userId, permission: Permission.Viewer }),
+      );
+
+      const result: HttpResult = await request(route("current"));
+
+      expect(result.status).toBe(200);
+      expect(json(result)).toEqual(buildAbsentFeedStatus(kind));
+      expect(findToken).not.toHaveBeenCalled();
+    });
+
+    test.each([undefined, at("2026-10-01T12:00:00Z")])(
+      "a viewer can read the link and expiration %p without exposing token hashes",
+      async (expiresAt: Date | undefined) => {
+        propsSpy.mockResolvedValue(
+          buildMemberProps({
+            projectId,
+            userId,
+            permission: Permission.Viewer,
+          }),
+        );
+        const row: FeedRowFixture = addFeed(expiresAt);
+        row.previousTokenHash = CalendarFeedToken.hash(
+          CalendarFeedToken.mint(),
+        );
+
+        const result: HttpResult = await request(route("current"));
+        const status: Record<string, unknown> = json(result);
+
+        expect(result.status).toBe(200);
+        expect(status["exists"]).toBe(true);
+        expect(status["needsRegeneration"]).toBe(false);
+        expect(status["previousTokenExpiresAt"]).toBe(
+          expiresAt?.toISOString() ?? null,
+        );
+        expect((status["urls"] as Record<string, string>)["https"]).toContain(
+          token,
+        );
+        expect(result.body).not.toContain(row.tokenHash);
+        expect(result.body).not.toContain(row.previousTokenHash);
+        expect(status).not.toHaveProperty("token");
+        expect(status).not.toHaveProperty("tokenHash");
+        expect(status).not.toHaveProperty("previousTokenHash");
+
+        const read: CapturedFindOneBy = find.mock
+          .calls[0]?.[0] as CapturedFindOneBy;
+        expect(read.select?.["previousTokenExpiresAt"]).toBe(true);
+        for (const secret of ["token", "tokenHash", "previousTokenHash"]) {
+          expect(read.select?.[secret]).toBeUndefined();
+        }
+        expect(findToken.mock.invocationCallOrder[0]).toBeGreaterThan(
+          find.mock.invocationCallOrder[0] as number,
+        );
+      },
+    );
+
+    test("first publish passes both caller status reads and returns a null expiration", async () => {
+      create.mockImplementation(async () => {
+        return addFeed();
+      });
+
+      const result: HttpResult = await postJson(route("publish"));
+
+      expect(result.status).toBe(200);
+      expect(create).toHaveBeenCalledTimes(1);
+      expect(find).toHaveBeenCalledTimes(2);
+      expect(json(result)["previousTokenExpiresAt"]).toBeNull();
+      expect(
+        (json(result)["urls"] as Record<string, string>)["https"],
+      ).toContain(token);
+    });
+
+    test("rotation passes both caller status reads and returns the previous link's expiration", async () => {
+      const row: FeedRowFixture = addFeed();
+      const expiresAt: Date = at("2026-10-01T12:00:00Z");
+      const newToken: string = CalendarFeedToken.mint();
+
+      rotate.mockImplementation(async (): Promise<CalendarFeedRotation> => {
+        row.previousTokenHash = row.tokenHash;
+        row.previousTokenExpiresAt = expiresAt;
+        row.tokenHash = CalendarFeedToken.hash(newToken);
+        row.tokenHint = newToken.slice(-4);
+        row.rotatedAt = NOW;
+
+        return {
+          token: newToken,
+          tokenHash: row.tokenHash,
+          tokenHint: row.tokenHint,
+          rotatedAt: NOW,
+          previousTokenHash: row.previousTokenHash,
+          previousTokenExpiresAt: expiresAt,
+        };
+      });
+
+      const result: HttpResult = await postJson(route("rotate"));
+
+      expect(result.status).toBe(200);
+      expect(find).toHaveBeenCalledTimes(2);
+      expect(update).toHaveBeenCalledTimes(1);
+      expect(rotate).toHaveBeenCalledTimes(1);
+      expect(json(result)["previousTokenExpiresAt"]).toBe(
+        expiresAt.toISOString(),
+      );
+      expect(
+        (json(result)["urls"] as Record<string, string>)["https"],
+      ).toContain(newToken);
+      expect(findToken).not.toHaveBeenCalled();
+      expect(result.body).not.toContain(token);
+    });
+
+    test.each(["current", "publish", "rotate"] as const)(
+      "%s refuses a member without shared-feed read permissions before secrets or writes",
+      async (action: "current" | "publish" | "rotate") => {
+        addFeed();
+        propsSpy.mockResolvedValue(
+          buildMemberProps({
+            projectId,
+            userId,
+            permission: Permission.CurrentUser,
+          }),
+        );
+
+        const result: HttpResult =
+          action === "current"
+            ? await request(route(action))
+            : await postJson(route(action));
+
+        expect(result.status).toBe(ExceptionCode.NotAuthorizedException);
+        expect(findToken).not.toHaveBeenCalled();
+        expect(create).not.toHaveBeenCalled();
+        expect(update).not.toHaveBeenCalled();
+        expect(rotate).not.toHaveBeenCalled();
+        expect(result.body).not.toContain(token);
+      },
+    );
+  },
+);
+
 // -- Session route: /my-shifts --------------------------------------------------
 
 describe("GET /on-call-calendar/my-shifts", () => {
@@ -4303,12 +4617,65 @@ describe("GET /on-call-calendar/my-shifts", () => {
     expect(materializeSpy).not.toHaveBeenCalled();
   });
 
-  test("an anonymous caller is refused", async () => {
+  /*
+   * Was a 400 ("A logged-in user is required." as BadDataException). The
+   * route's requireUserId now goes through CommonAPI.assertAuthenticatedUser,
+   * which answers a caller with no credentials with 401 - the status the
+   * dashboard and the mobile app both answer by refreshing the session.
+   */
+  test("an anonymous caller is refused with 401", async () => {
     propsSpy.mockResolvedValue({ tenantId: undefined, userId: undefined });
 
     const result: HttpResult = await request(`${API_PREFIX}${MY_SHIFTS_ROUTE}`);
 
-    expect(result.status).toBe(ExceptionCode.BadDataException);
+    expect(result.status).toBe(ExceptionCode.NotAuthenticatedException);
+    expect(result.status).toBe(401);
+    expect(json(result)["message"]).toBe(
+      CommonAPI.AUTHENTICATION_REQUIRED_MESSAGE,
+    );
+    expect(materializeSpy).not.toHaveBeenCalled();
+  });
+
+  test("an anonymous caller with a tenant header is refused with 401 too", async () => {
+    propsSpy.mockResolvedValue(
+      buildMemberProps({ projectId, userId: undefined }),
+    );
+
+    const result: HttpResult = await request(`${API_PREFIX}${MY_SHIFTS_ROUTE}`);
+
+    expect(result.status).toBe(ExceptionCode.NotAuthenticatedException);
+    expect(materializeSpy).not.toHaveBeenCalled();
+  });
+
+  /*
+   * An API key is authenticated, so it is not a 401 - but "my shifts" needs a
+   * person, so it is refused as not authorised (422) with the route's own
+   * message. This used to be a BadDataException (400) with the same text.
+   */
+  test("a project API key without a tenant header is refused with 422 'A logged-in user is required.'", async () => {
+    propsSpy.mockResolvedValue({
+      tenantId: undefined,
+      userId: undefined,
+      userType: UserType.API,
+    });
+
+    const result: HttpResult = await request(`${API_PREFIX}${MY_SHIFTS_ROUTE}`);
+
+    expect(result.status).toBe(ExceptionCode.NotAuthorizedException);
+    expect(json(result)["message"]).toBe("A logged-in user is required.");
+    expect(materializeSpy).not.toHaveBeenCalled();
+  });
+
+  test("a project API key with a tenant header gets the same 422 - the user check runs first on this route", async () => {
+    propsSpy.mockResolvedValue({
+      ...buildMemberProps({ projectId, userId: undefined }),
+      userType: UserType.API,
+    });
+
+    const result: HttpResult = await request(`${API_PREFIX}${MY_SHIFTS_ROUTE}`);
+
+    expect(result.status).toBe(ExceptionCode.NotAuthorizedException);
+    expect(json(result)["message"]).toBe("A logged-in user is required.");
     expect(materializeSpy).not.toHaveBeenCalled();
   });