@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Server/Services/DatabaseServiceTenantRelationGuard.test.ts

@@ -0,0 +1,259 @@
+import Incident from "../../../Models/DatabaseModels/Incident";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import Project from "../../../Models/DatabaseModels/Project";
+import IncidentService from "../../../Server/Services/IncidentService";
+import MonitorService from "../../../Server/Services/MonitorService";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, { UserPermission } from "../../../Types/Permission";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import { getJestSpyOn } from "../../Spy";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * PasswordHash has a known TS5.9 compile failure under ts-jest that breaks any
+ * suite whose import graph reaches it (see ApiKeyPermissionSecurity.test.ts).
+ * Nothing here touches password hashing; stub it before the service import
+ * graph drags it into compilation.
+ */
+jest.mock("../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: class PasswordHashStub {},
+  };
+});
+
+/*
+ * Cross-tenant write via the tenant RELATION (confused deputy).
+ *
+ * A tenant model declares its tenant twice — the scalar `projectId` column and
+ * the `project` @ManyToOne relation joined on that same column — and both are
+ * writable by an ordinary member on create. `DatabaseService.create` stamps
+ * only the scalar to `props.tenantId`; TypeORM then lets the relation object
+ * override the scalar join value on the INSERT, so a member of project A who
+ * posts `project: { _id: B }` writes the row into project B.
+ *
+ * `enforceTenantRelationMatchesScalar` rejects a tenant relation pointing at a
+ * different project and deletes it so the stamped scalar is the only thing
+ * that reaches the database. These tests drive the real `create()` pipeline
+ * (only the IO/validation neighbours that are orthogonal to tenancy are
+ * stubbed) and the guard directly for the update-shaped (plain object) input.
+ */
+
+const PROJECT_A: ObjectID = new ObjectID(
+  "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+);
+const PROJECT_B: ObjectID = new ObjectID(
+  "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+);
+
+function userPermission(permission: Permission): UserPermission {
+  return {
+    permission,
+    labelIds: [],
+    isBlockPermission: false,
+    _type: "UserPermission",
+  };
+}
+
+function memberProps(
+  tenantId: ObjectID = PROJECT_A,
+): DatabaseCommonInteractionProps {
+  return {
+    userId: new ObjectID("dddddddd-dddd-4ddd-8ddd-dddddddddddd"),
+    tenantId,
+    ignoreHooks: true,
+    userGlobalAccessPermission: {
+      projectIds: [tenantId],
+      globalPermissions: [Permission.Public, Permission.User],
+      _type: "UserGlobalAccessPermission",
+    },
+    userTenantAccessPermission: {
+      [tenantId.toString()]: {
+        projectId: tenantId,
+        permissions: [userPermission(Permission.ProjectMember)],
+        _type: "UserTenantAccessPermission",
+      },
+    },
+  };
+}
+
+function rootProps(): DatabaseCommonInteractionProps {
+  return { isRoot: true, ignoreHooks: true };
+}
+
+type Target = {
+  name: string;
+  service: typeof MonitorService | typeof IncidentService;
+  build: () => Monitor | Incident;
+};
+
+const TARGETS: Array<Target> = [
+  {
+    name: "Monitor",
+    service: MonitorService,
+    build: () => {
+      const monitor: Monitor = new Monitor();
+      monitor.name = "guard-test";
+      return monitor;
+    },
+  },
+  {
+    name: "Incident",
+    service: IncidentService,
+    build: () => {
+      const incident: Incident = new Incident();
+      incident.title = "guard-test";
+      return incident;
+    },
+  },
+];
+
+function projectRelation(id: ObjectID): Project {
+  const project: Project = new Project();
+  project._id = id.toString();
+  return project;
+}
+
+describe("DatabaseService tenant-relation cross-tenant write guard", () => {
+  describe.each(TARGETS)("$name create()", (target: Target) => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const service: any = target.service;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let save: jest.Mock<(entity: any) => Promise<any>>;
+
+    beforeEach(() => {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      save = jest.fn(async (entity: any) => {
+        return entity;
+      }) as any;
+      getJestSpyOn(service, "getRepository").mockReturnValue({
+        save,
+      } as never);
+      // Count-backed validators (unique/limit checks) must not hit Postgres.
+      getJestSpyOn(service, "countBy").mockResolvedValue(
+        new PositiveNumber(0) as never,
+      );
+      /*
+       * Required-field validation is orthogonal to the tenancy guard under
+       * test; keep it from failing on unrelated columns.
+       */
+      getJestSpyOn(service, "checkRequiredFields").mockImplementation(((
+        data: unknown,
+      ) => {
+        return data;
+      }) as never);
+      // Fire-and-forget side effects that would otherwise reach the network.
+      getJestSpyOn(service, "onTriggerWorkflow").mockResolvedValue(
+        undefined as never,
+      );
+      getJestSpyOn(service, "onTriggerRealtime").mockResolvedValue(
+        undefined as never,
+      );
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+    });
+
+    test("rejects a create whose project relation points at another project", async () => {
+      const data: Monitor | Incident = target.build();
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (data as any).project = projectRelation(PROJECT_B);
+
+      await expect(
+        service.create({ data, props: memberProps(PROJECT_A) }),
+      ).rejects.toThrow(BadDataException);
+
+      expect(save).not.toHaveBeenCalled();
+    });
+
+    test("drops a matching project relation and persists under the request tenant only", async () => {
+      const data: Monitor | Incident = target.build();
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (data as any).project = projectRelation(PROJECT_A);
+
+      await service.create({ data, props: memberProps(PROJECT_A) });
+
+      expect(save).toHaveBeenCalledTimes(1);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const saved: any = save.mock.calls[0]![0];
+      expect(saved.project).toBeUndefined();
+      expect(saved.projectId?.toString()).toBe(PROJECT_A.toString());
+    });
+
+    test("leaves the project relation untouched for a root/internal caller", async () => {
+      const data: Monitor | Incident = target.build();
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (data as any).project = projectRelation(PROJECT_B);
+
+      await service.create({ data, props: rootProps() });
+
+      expect(save).toHaveBeenCalledTimes(1);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const saved: any = save.mock.calls[0]![0];
+      expect(saved.project).toBeInstanceOf(Project);
+      expect(saved.project._id).toBe(PROJECT_B.toString());
+    });
+  });
+
+  /*
+   * The same guard runs on the update path, where the payload is a plain
+   * object (BaseAPI.updateItem deserializes rather than fromJSON'ing), so the
+   * relation arrives as `{ _id: ... }` rather than a Project instance.
+   */
+  describe("enforceTenantRelationMatchesScalar (update-shaped input)", () => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const guard: any = MonitorService;
+
+    test("throws when a plain-object project relation points at another project", () => {
+      const data: Record<string, unknown> = {
+        name: "x",
+        project: { _id: PROJECT_B.toString() },
+      };
+
+      expect(() => {
+        guard.enforceTenantRelationMatchesScalar(data, memberProps(PROJECT_A));
+      }).toThrow(BadDataException);
+    });
+
+    test("strips a matching plain-object project relation", () => {
+      const data: Record<string, unknown> = {
+        name: "x",
+        project: { _id: PROJECT_A.toString() },
+      };
+
+      guard.enforceTenantRelationMatchesScalar(data, memberProps(PROJECT_A));
+
+      expect(data["project"]).toBeUndefined();
+      expect(data["name"]).toBe("x");
+    });
+
+    test("is a no-op when no project relation is supplied", () => {
+      const data: Record<string, unknown> = { name: "x" };
+
+      expect(() => {
+        guard.enforceTenantRelationMatchesScalar(data, memberProps(PROJECT_A));
+      }).not.toThrow();
+      expect(data).toEqual({ name: "x" });
+    });
+
+    test("does not touch the relation for a root/internal caller", () => {
+      const data: Record<string, unknown> = {
+        project: { _id: PROJECT_B.toString() },
+      };
+
+      guard.enforceTenantRelationMatchesScalar(data, rootProps());
+
+      expect(data["project"]).toEqual({ _id: PROJECT_B.toString() });
+    });
+  });
+});

package/Tests/Server/Services/DatabaseServiceWriteOperatorValues.test.ts

@@ -0,0 +1,147 @@
+import ProbeService from "../../../Server/Services/ProbeService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Probe from "../../../Models/DatabaseModels/Probe";
+import StartsWith from "../../../Types/BaseDatabase/StartsWith";
+import NotNull from "../../../Types/BaseDatabase/NotNull";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * Query operators belong in the `query` of a read/update, never in the `data`
+ * of a write. A request value shaped like a serialized operator, e.g.
+ * {"_type":"StartsWith","value":"a"} or {"_type":"NotNull"}, becomes a real
+ * operator instance: JSONFunctions.deserialize runs on every request body while
+ * DatabaseBaseModel._fromJSON builds the model, and the operator is assigned to
+ * the column unchanged.
+ *
+ * An operator is never a valid stored value, and one left on a write payload is
+ * also fed to the lookups built from that data (the uniqueness check, service
+ * hooks), where it turns an intended exact comparison into a pattern match.
+ * DatabaseService rejects such a write up front, before any hook or query runs.
+ * JSON columns are exempt - they legitimately hold arbitrary objects.
+ *
+ * The first two tests document the deserialization behaviour, which is
+ * unchanged; the last two pin the rejection and that ordinary writes still pass.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "00000000-0000-4000-8000-00000000000a",
+);
+
+const memberProps: (
+  permissions: Array<Permission>,
+) => DatabaseCommonInteractionProps = (
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps => {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId: PROJECT_ID,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission): UserPermission => {
+      return {
+        _type: "UserPermission",
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId: new ObjectID("00000000-0000-4000-8000-000000000003"),
+    tenantId: PROJECT_ID,
+    userType: UserType.User,
+    userTenantAccessPermission: {
+      [PROJECT_ID.toString()]: tenantPermission,
+    },
+  };
+};
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("Query operators supplied as write values", () => {
+  test("request body value {_type:StartsWith} deserializes into a StartsWith on a text column", () => {
+    const body: JSONObject = {
+      key: { _type: "StartsWith", value: "a" } as unknown as JSONObject,
+      name: "a probe",
+    };
+
+    const probe: Probe = BaseModel.fromJSON<Probe>(body, Probe) as Probe;
+
+    expect(probe.key).toBeInstanceOf(StartsWith);
+    expect((probe.key as unknown as StartsWith<string>).toString()).toBe("a");
+  });
+
+  test("request body value {_type:NotNull} deserializes into a NotNull operator", () => {
+    const body: JSONObject = {
+      key: { _type: "NotNull" } as unknown as JSONObject,
+    };
+
+    const probe: Probe = BaseModel.fromJSON<Probe>(body, Probe) as Probe;
+    expect(probe.key).toBeInstanceOf(NotNull);
+  });
+
+  test("DatabaseService.create rejects an operator in write data before any lookup", async () => {
+    /*
+     * If the check regresses, the uniqueness check would run its countBy with
+     * the operator in the query; make that fail loudly instead.
+     */
+    const countSpy: jest.SpyInstance = jest
+      .spyOn(ProbeService, "countBy")
+      .mockImplementation((() => {
+        throw new Error("countBy must not run for an operator-carrying create");
+      }) as never) as unknown as jest.SpyInstance;
+    const hookSpy: jest.SpyInstance = jest.spyOn(
+      ProbeService,
+      "onBeforeCreate" as never,
+    ) as unknown as jest.SpyInstance;
+
+    const probe: Probe = new Probe();
+    (probe as unknown as { key: unknown }).key = new StartsWith("a");
+    probe.name = "a probe";
+
+    const createBy: CreateBy<Probe> = {
+      data: probe,
+      props: memberProps([Permission.CreateProjectProbe]),
+    };
+
+    await expect(ProbeService.create(createBy)).rejects.toBeInstanceOf(
+      BadDataException,
+    );
+    expect(hookSpy).not.toHaveBeenCalled();
+    expect(countSpy).not.toHaveBeenCalled();
+  });
+
+  test("the operator check leaves an ordinary create untouched", () => {
+    /*
+     * The check must refuse operators without touching plain values. Call it
+     * directly - it is the choke point create()/update() run - and assert a
+     * normal payload passes while an operator is refused.
+     */
+    const legit: Probe = new Probe();
+    legit.key = "a-real-plaintext-key";
+    legit.name = "a probe";
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const service: any = ProbeService as any;
+    expect(() => {
+      service.rejectQueryOperatorsInData(legit);
+    }).not.toThrow();
+
+    const withOperator: Probe = new Probe();
+    (withOperator as unknown as { key: unknown }).key = new StartsWith("a");
+    expect(() => {
+      service.rejectQueryOperatorsInData(withOperator);
+    }).toThrow(BadDataException);
+  });
+});

package/Tests/Server/Services/EnterpriseLicenseServiceKeyGeneration.test.ts

@@ -0,0 +1,151 @@
+import EnterpriseLicenseService, {
+  ENTERPRISE_LICENSE_KEY_RANDOM_BYTES,
+  generateEnterpriseLicenseKey,
+} from "../../../Server/Services/EnterpriseLicenseService";
+import { OnCreate } from "../../../Server/Types/Database/Hooks";
+import EnterpriseLicense from "../../../Models/DatabaseModels/EnterpriseLicense";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import crypto from "crypto";
+import { afterEach, describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * License keys are generated on the SERVER when the admin leaves the field
+ * blank. They used to be made in the browser (UUID.generate() in the Admin
+ * Dashboard's create form), so the only randomness guarding a customer's
+ * license came from whatever the admin's browser supplied.
+ *
+ * Pinned: a blank key becomes 32 CSPRNG bytes (64 hex characters, within the
+ * ShortText column), a typed key is kept (trimmed - installations trim what
+ * they send, so stored whitespace would make a key unmatchable), and the hook
+ * runs in onBeforeCreate - before DatabaseService's required-column check,
+ * which would otherwise reject the blank key.
+ */
+
+type RunBeforeCreateFunction = (
+  license: EnterpriseLicense,
+) => Promise<EnterpriseLicense>;
+
+const runBeforeCreate: RunBeforeCreateFunction = async (
+  license: EnterpriseLicense,
+): Promise<EnterpriseLicense> => {
+  const result: OnCreate<EnterpriseLicense> = await (
+    EnterpriseLicenseService as unknown as {
+      onBeforeCreate: (
+        createBy: unknown,
+      ) => Promise<OnCreate<EnterpriseLicense>>;
+    }
+  ).onBeforeCreate({
+    data: license,
+    props: { isRoot: true },
+  });
+
+  return result.createBy.data;
+};
+
+const HEX_KEY: RegExp = /^[0-9a-f]{64}$/;
+
+describe("EnterpriseLicenseService license key generation", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("generateEnterpriseLicenseKey", () => {
+    it("is 32 random bytes written as 64 lower-case hex characters", () => {
+      expect(ENTERPRISE_LICENSE_KEY_RANDOM_BYTES).toBe(32);
+      expect(generateEnterpriseLicenseKey()).toMatch(HEX_KEY);
+    });
+
+    it("fits the licenseKey column", () => {
+      expect(generateEnterpriseLicenseKey().length).toBeLessThanOrEqual(
+        ColumnLength.ShortText,
+      );
+    });
+
+    it("comes from crypto.randomBytes", () => {
+      const randomBytes: ReturnType<typeof jest.spyOn> = jest.spyOn(
+        crypto,
+        "randomBytes",
+      );
+
+      generateEnterpriseLicenseKey();
+
+      expect(randomBytes).toHaveBeenCalledWith(32);
+    });
+
+    it("never repeats", () => {
+      const keys: Set<string> = new Set<string>();
+
+      for (let index: number = 0; index < 500; index++) {
+        keys.add(generateEnterpriseLicenseKey());
+      }
+
+      expect(keys.size).toBe(500);
+    });
+  });
+
+  describe("onBeforeCreate", () => {
+    it("generates a key when the admin left it out entirely", async () => {
+      const license: EnterpriseLicense = BaseModel.fromJSON(
+        { companyName: "Acme, Inc.", expiresAt: "2027-01-01" },
+        EnterpriseLicense,
+      ) as EnterpriseLicense;
+
+      expect((await runBeforeCreate(license)).licenseKey).toMatch(HEX_KEY);
+    });
+
+    it.each([
+      ["an empty string", ""],
+      ["whitespace", "   \t "],
+    ])(
+      "generates a key when the admin submitted %s",
+      async (_label: string, licenseKey: string) => {
+        const license: EnterpriseLicense = new EnterpriseLicense();
+        license.companyName = "Acme, Inc.";
+        license.licenseKey = licenseKey;
+
+        expect((await runBeforeCreate(license)).licenseKey).toMatch(HEX_KEY);
+      },
+    );
+
+    it("keeps a key the admin typed, trimmed", async () => {
+      const license: EnterpriseLicense = new EnterpriseLicense();
+      license.companyName = "Acme, Inc.";
+      license.licenseKey = "  b6f4c1a2-1111-2222-3333-444455556666\n";
+
+      expect((await runBeforeCreate(license)).licenseKey).toBe(
+        "b6f4c1a2-1111-2222-3333-444455556666",
+      );
+    });
+
+    it("gives two blank-key licenses different keys", async () => {
+      const first: EnterpriseLicense = new EnterpriseLicense();
+      const second: EnterpriseLicense = new EnterpriseLicense();
+
+      expect((await runBeforeCreate(first)).licenseKey).not.toBe(
+        (await runBeforeCreate(second)).licenseKey,
+      );
+    });
+
+    it("hands the same create request on, with nothing carried forward", async () => {
+      const license: EnterpriseLicense = new EnterpriseLicense();
+      const createBy: { data: EnterpriseLicense; props: { isRoot: boolean } } =
+        {
+          data: license,
+          props: { isRoot: true },
+        };
+
+      const result: OnCreate<EnterpriseLicense> = await (
+        EnterpriseLicenseService as unknown as {
+          onBeforeCreate: (
+            createBy: unknown,
+          ) => Promise<OnCreate<EnterpriseLicense>>;
+        }
+      ).onBeforeCreate(createBy);
+
+      expect(result.createBy).toBe(createBy);
+      expect(result.createBy.data).toBe(license);
+      expect(result.carryForward).toBeUndefined();
+    });
+  });
+});