@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Server/Services/CreateAndReadResponsesKeepIds.test.ts

@@ -0,0 +1,263 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import ProjectSCIM from "../../../Models/DatabaseModels/ProjectSCIM";
+import ProjectSso from "../../../Models/DatabaseModels/ProjectSso";
+import User from "../../../Models/DatabaseModels/User";
+import ProjectSCIMService from "../../../Server/Services/ProjectSCIMService";
+import ProjectSSOService from "../../../Server/Services/ProjectSsoService";
+import UserService from "../../../Server/Services/UserService";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, { UserPermission } from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * WHY THIS FILE EXISTS.
+ *
+ * A project owner's POST /api/project-scim answered 200 with every column of
+ * the new row EXCEPT "_id", and the get-list that followed - selecting
+ * {_id:true, name:true} - came back as [{name}]. Nothing was wrong with the
+ * data or the query: the row carried its real `_id` in memory and `_id`
+ * reached TypeORM in the projection. The id was dropped while serializing the
+ * response, because DatabaseBaseModel.toJSONObject iterates a column list that
+ * is cached per model class, and that cache had been built from the create
+ * path's own mutilated model instance - BaseAPI.createItem deleted `_id` off
+ * it, and DatabaseService.create asks that instance for its columns
+ * (generateDefaultValues) on the way through. One create poisoned the class
+ * for the life of the process, for every later caller.
+ *
+ * These tests drive the real services with a mocked repository - no database -
+ * and deliberately delete `_id` off the model handed to create(), which is
+ * what the API used to do. They assert the whole round trip keeps its ids
+ * anyway. Each test uses a different model because the caches are per class
+ * and per process: reusing one would leave a warm cache and pass vacuously.
+ *
+ * Three callers, because of how the create path's accidental mitigation
+ * behaves. enforceTenantRelationMatchesScalar runs two lines before
+ * generateDefaultValues and warms the cache from the service's own healthy
+ * model, so it hides the bug for some callers and not others:
+ *   a) a project owner on a tenant-scoped model - COVERED by that mitigation,
+ *      so this case passes even with the fix reverted. It is here as the
+ *      shape of the reported incident and to keep it working, not as the
+ *      test that catches a regression: the live incident needed an earlier
+ *      poisoning create (b or c) to have happened in the same process first.
+ *   b) an isRoot caller, which returns before that guard runs - this one
+ *      fails without the fix
+ *   c) a REFUSED create on a model with no tenant column - also fails without
+ *      the fix, and proves that a request nobody was allowed to make cannot
+ *      poison anything, since the columns are read ~20 lines before the
+ *      create permission check
+ *
+ * The instance-independence invariant itself is pinned by
+ * Tests/Types/Database/CanonicalModelInstance.test.ts, which fails for every
+ * model if the fix regresses. These three are the end-to-end evidence.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+);
+const USER_ID: ObjectID = new ObjectID("bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb");
+const ROW_ID: string = "22222222-2222-4222-8222-222222222222";
+
+function ownerProps(): DatabaseCommonInteractionProps {
+  const permissions: Array<UserPermission> = [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+  ].map((permission: Permission) => {
+    return {
+      permission: permission,
+      labelIds: [],
+      isBlockPermission: false,
+      _type: "UserPermission" as const,
+    };
+  });
+
+  return {
+    userId: USER_ID,
+    tenantId: PROJECT_ID,
+    userType: UserType.User,
+    userTenantAccessPermission: {
+      [PROJECT_ID.toString()]: {
+        projectId: PROJECT_ID,
+        permissions: permissions,
+        _type: "UserTenantAccessPermission",
+      },
+    },
+  };
+}
+
+function loggedInUserProps(): DatabaseCommonInteractionProps {
+  return {
+    ...ownerProps(),
+    userGlobalAccessPermission: {
+      projectIds: [PROJECT_ID],
+      globalPermissions: [Permission.CurrentUser],
+      _type: "UserGlobalAccessPermission",
+    },
+  };
+}
+
+/*
+ * Stands in for Postgres: `save` stamps the generated uuid onto the entity the
+ * way the driver writes it back, and `find` returns a row that has one.
+ */
+function mockRepository(
+  service: unknown,
+  modelType: { new (): BaseModel },
+  rowFields: JSONObject,
+): void {
+  const repository: Record<string, unknown> = {
+    save: async (entity: BaseModel): Promise<BaseModel> => {
+      entity._id = ROW_ID;
+      return entity;
+    },
+    find: async (): Promise<Array<BaseModel>> => {
+      const row: BaseModel = new modelType();
+      row._id = ROW_ID;
+      Object.assign(row, rowFields);
+      return [row];
+    },
+    findOneBy: async (): Promise<null> => {
+      return null;
+    },
+    count: async (): Promise<number> => {
+      return 0;
+    },
+  };
+
+  jest
+    .spyOn(service as never, "getRepository" as never)
+    .mockReturnValue(repository as never);
+}
+
+/* What BaseAPI.createItem used to hand the service: `_id` deleted outright. */
+function payloadWithIdDeleted<T extends BaseModel>(
+  json: JSONObject,
+  modelType: { new (): T },
+): T {
+  const item: T = BaseModel.fromJSON<T>(json, modelType) as T;
+  delete (item as unknown as Record<string, unknown>)["_id"];
+
+  return item;
+}
+
+describe("create and read responses keep their _id", () => {
+  test("a project owner creating and then listing a tenant-scoped model (the incident's shape; the create path's tenant guard already covered this one)", async () => {
+    mockRepository(ProjectSCIMService, ProjectSCIM, { name: "listed scim" });
+
+    const savedItem: ProjectSCIM = await ProjectSCIMService.create({
+      data: payloadWithIdDeleted<ProjectSCIM>(
+        {
+          name: "created scim",
+          projectId: PROJECT_ID.toString(),
+          bearerToken: "scim-token",
+        },
+        ProjectSCIM,
+      ),
+      props: ownerProps(),
+    });
+
+    const createResponse: JSONObject = BaseModel.toJSON(savedItem, ProjectSCIM);
+
+    expect(savedItem._id).toBe(ROW_ID);
+    expect(createResponse["_id"]).toBe(ROW_ID);
+
+    const rows: Array<ProjectSCIM> = await ProjectSCIMService.findBy({
+      query: { projectId: PROJECT_ID },
+      select: { _id: true, name: true } as never,
+      limit: 50,
+      skip: 0,
+      props: ownerProps(),
+    });
+
+    const listResponse: JSONArray = BaseModel.toJSONObjectArray(
+      rows,
+      ProjectSCIM,
+    );
+
+    expect(rows[0]?._id).toBe(ROW_ID);
+    expect((listResponse[0] as JSONObject)["_id"]).toBe(ROW_ID);
+    expect((listResponse[0] as JSONObject)["name"]).toBe("listed scim");
+  });
+
+  test("an isRoot caller creating, then a project owner listing", async () => {
+    /*
+     * isRoot returns from enforceTenantRelationMatchesScalar before it can
+     * warm the column cache, so on master this create was the first thing to
+     * describe the class - and it described it without an id.
+     */
+    mockRepository(ProjectSSOService, ProjectSso, { name: "listed sso" });
+
+    const savedItem: ProjectSso = await ProjectSSOService.create({
+      data: payloadWithIdDeleted<ProjectSso>(
+        {
+          name: "created sso",
+          description: "created by the root caller",
+          projectId: PROJECT_ID.toString(),
+          signatureMethod: "RSA-SHA256",
+          digestMethod: "SHA256",
+          signOnURL: "https://example.com/sso",
+          issuerURL: "https://example.com",
+          publicCertificate: "a-certificate",
+        },
+        ProjectSso,
+      ),
+      props: { isRoot: true },
+    });
+
+    expect(BaseModel.toJSON(savedItem, ProjectSso)["_id"]).toBe(ROW_ID);
+
+    const rows: Array<ProjectSso> = await ProjectSSOService.findBy({
+      query: { projectId: PROJECT_ID },
+      select: { _id: true, name: true } as never,
+      limit: 50,
+      skip: 0,
+      props: ownerProps(),
+    });
+
+    const listResponse: JSONArray = BaseModel.toJSONObjectArray(
+      rows,
+      ProjectSso,
+    );
+
+    expect((listResponse[0] as JSONObject)["_id"]).toBe(ROW_ID);
+  });
+
+  test("a REFUSED create on a model with no tenant column cannot strip ids from later reads", async () => {
+    /*
+     * User.create is `[]` - nobody may POST /api/user - and User has no
+     * @TenantColumn, so neither the permission check nor the tenant guard
+     * stood between the request and the column cache. One authenticated POST
+     * that always 4xxs was enough to strip `_id` from every User response the
+     * process served afterwards.
+     */
+    mockRepository(UserService, User, {
+      email: { _type: "Email", value: "someone@example.com" },
+    });
+
+    await expect(
+      UserService.create({
+        data: payloadWithIdDeleted<User>(
+          { email: "attacker@example.com" },
+          User,
+        ),
+        props: loggedInUserProps(),
+      }),
+    ).rejects.toThrow(/not allowed/i);
+
+    const rows: Array<User> = await UserService.findBy({
+      query: { _id: USER_ID.toString() } as never,
+      select: { _id: true, email: true } as never,
+      limit: 10,
+      skip: 0,
+      props: loggedInUserProps(),
+    });
+
+    const listResponse: JSONArray = BaseModel.toJSONObjectArray(rows, User);
+
+    expect(rows[0]?._id).toBe(ROW_ID);
+    expect((listResponse[0] as JSONObject)["_id"]).toBe(ROW_ID);
+  });
+});

package/Tests/Server/Services/DatabaseServiceCreateSuppliedId.test.ts

@@ -0,0 +1,147 @@
+import MonitorService from "../../../Server/Services/MonitorService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * A create builds a brand-new row, so the payload must not carry the row's own
+ * primary key. `getRepository().save()` treats an entity that already has an id
+ * as an update of that existing row rather than an insert, so an `_id` left on
+ * a create payload makes the "create" modify a record the caller never named.
+ *
+ * Two layers keep that from happening, and these tests pin both:
+ *   - BaseAPI.createItem strips the top-level id from the model it builds
+ *     (BaseModel.fromJSON folds a client `id` into `_id`, so both spellings go).
+ *   - DatabaseService.create refuses a pre-set `_id` from a non-root caller
+ *     before any hook or query runs. Root/internal seeding assigns ids and is
+ *     exempt.
+ *
+ * Nested `_id`s inside relation objects/arrays are left alone - they reference
+ * existing related rows and are a normal part of a create payload.
+ */
+
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "00000000-0000-4000-8000-00000000000a",
+);
+const CALLER_PROJECT_ID: ObjectID = new ObjectID(
+  "00000000-0000-4000-8000-00000000000b",
+);
+// The id of a row that already exists.
+const EXISTING_ROW_ID: string = "00000000-0000-4000-8000-0000000000cc";
+
+const memberProps: (
+  permissions: Array<Permission>,
+) => DatabaseCommonInteractionProps = (
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps => {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId: CALLER_PROJECT_ID,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission): UserPermission => {
+      return {
+        _type: "UserPermission",
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId: new ObjectID("00000000-0000-4000-8000-000000000003"),
+    tenantId: CALLER_PROJECT_ID,
+    userType: UserType.User,
+    userTenantAccessPermission: {
+      [CALLER_PROJECT_ID.toString()]: tenantPermission,
+    },
+  };
+};
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("Primary keys supplied on a create payload", () => {
+  test("BaseAPI.createItem strips the top-level id its model builder produced", () => {
+    /*
+     * BaseModel.fromJSON maps a client `id` -> `_id` and keeps `_id`; this is
+     * how a request body's id ends up on the entity in the first place.
+     */
+    const created: Monitor = BaseModel.fromJSON<Monitor>(
+      { id: EXISTING_ROW_ID, name: "x" } as JSONObject,
+      Monitor,
+    ) as Monitor;
+    expect(created._id).toBe(EXISTING_ROW_ID);
+
+    // What BaseAPI.createItem now does to that entity before create().
+    delete (created as unknown as { _id?: string })._id;
+    delete (created as unknown as { id?: string }).id;
+    expect(created._id).toBeUndefined();
+
+    /*
+     * A nested relation id (Entity/EntityArray) must survive that strip - it
+     * references an existing related row, not the row being created.
+     */
+    const withRelation: Monitor = BaseModel.fromJSON<Monitor>(
+      {
+        _id: EXISTING_ROW_ID,
+        name: "x",
+        labels: [{ _id: "00000000-0000-4000-8000-0000000000dd" }],
+      } as JSONObject,
+      Monitor,
+    ) as Monitor;
+    delete (withRelation as unknown as { _id?: string })._id;
+    expect(withRelation._id).toBeUndefined();
+    expect(
+      (withRelation.labels && withRelation.labels[0]?._id) || undefined,
+    ).toBe("00000000-0000-4000-8000-0000000000dd");
+  });
+
+  test("DatabaseService.create refuses a non-root create carrying an _id, before any hook or query", async () => {
+    /*
+     * If the refusal ever regresses, the spies below would let a full create
+     * run; fail loudly instead by making the first thing create() would reach
+     * after the check throw.
+     */
+    const repoSpy: jest.SpyInstance = jest
+      .spyOn(MonitorService, "getRepository")
+      .mockImplementation((() => {
+        throw new Error("save() must not be reached for an _id create");
+      }) as never) as unknown as jest.SpyInstance;
+    const hookSpy: jest.SpyInstance = jest.spyOn(
+      MonitorService,
+      "onBeforeCreate" as never,
+    ) as unknown as jest.SpyInstance;
+
+    const incoming: Monitor = new Monitor();
+    incoming._id = EXISTING_ROW_ID;
+    incoming.name = "renamed";
+
+    const createBy: CreateBy<Monitor> = {
+      data: incoming,
+      props: memberProps([
+        Permission.CreateProjectMonitor,
+        Permission.ProjectMember,
+      ]),
+    };
+
+    await expect(MonitorService.create(createBy)).rejects.toBeInstanceOf(
+      BadDataException,
+    );
+    expect(hookSpy).not.toHaveBeenCalled();
+    expect(repoSpy).not.toHaveBeenCalled();
+
+    // Guard against a false pass if the two ids were ever made equal.
+    expect(OTHER_PROJECT_ID.toString()).not.toBe(CALLER_PROJECT_ID.toString());
+  });
+});