@oneuptime/common 13.0.8 → 14.0.0

package/Tests/Server/Services/CreateAndReadResponsesKeepIds.test.ts

@@ -0,0 +1,263 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import ProjectSCIM from "../../../Models/DatabaseModels/ProjectSCIM";
+import ProjectSso from "../../../Models/DatabaseModels/ProjectSso";
+import User from "../../../Models/DatabaseModels/User";
+import ProjectSCIMService from "../../../Server/Services/ProjectSCIMService";
+import ProjectSSOService from "../../../Server/Services/ProjectSsoService";
+import UserService from "../../../Server/Services/UserService";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, { UserPermission } from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * WHY THIS FILE EXISTS.
+ *
+ * A project owner's POST /api/project-scim answered 200 with every column of
+ * the new row EXCEPT "_id", and the get-list that followed - selecting
+ * {_id:true, name:true} - came back as [{name}]. Nothing was wrong with the
+ * data or the query: the row carried its real `_id` in memory and `_id`
+ * reached TypeORM in the projection. The id was dropped while serializing the
+ * response, because DatabaseBaseModel.toJSONObject iterates a column list that
+ * is cached per model class, and that cache had been built from the create
+ * path's own mutilated model instance - BaseAPI.createItem deleted `_id` off
+ * it, and DatabaseService.create asks that instance for its columns
+ * (generateDefaultValues) on the way through. One create poisoned the class
+ * for the life of the process, for every later caller.
+ *
+ * These tests drive the real services with a mocked repository - no database -
+ * and deliberately delete `_id` off the model handed to create(), which is
+ * what the API used to do. They assert the whole round trip keeps its ids
+ * anyway. Each test uses a different model because the caches are per class
+ * and per process: reusing one would leave a warm cache and pass vacuously.
+ *
+ * Three callers, because of how the create path's accidental mitigation
+ * behaves. enforceTenantRelationMatchesScalar runs two lines before
+ * generateDefaultValues and warms the cache from the service's own healthy
+ * model, so it hides the bug for some callers and not others:
+ *   a) a project owner on a tenant-scoped model - COVERED by that mitigation,
+ *      so this case passes even with the fix reverted. It is here as the
+ *      shape of the reported incident and to keep it working, not as the
+ *      test that catches a regression: the live incident needed an earlier
+ *      poisoning create (b or c) to have happened in the same process first.
+ *   b) an isRoot caller, which returns before that guard runs - this one
+ *      fails without the fix
+ *   c) a REFUSED create on a model with no tenant column - also fails without
+ *      the fix, and proves that a request nobody was allowed to make cannot
+ *      poison anything, since the columns are read ~20 lines before the
+ *      create permission check
+ *
+ * The instance-independence invariant itself is pinned by
+ * Tests/Types/Database/CanonicalModelInstance.test.ts, which fails for every
+ * model if the fix regresses. These three are the end-to-end evidence.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+);
+const USER_ID: ObjectID = new ObjectID("bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb");
+const ROW_ID: string = "22222222-2222-4222-8222-222222222222";
+
+function ownerProps(): DatabaseCommonInteractionProps {
+  const permissions: Array<UserPermission> = [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+  ].map((permission: Permission) => {
+    return {
+      permission: permission,
+      labelIds: [],
+      isBlockPermission: false,
+      _type: "UserPermission" as const,
+    };
+  });
+
+  return {
+    userId: USER_ID,
+    tenantId: PROJECT_ID,
+    userType: UserType.User,
+    userTenantAccessPermission: {
+      [PROJECT_ID.toString()]: {
+        projectId: PROJECT_ID,
+        permissions: permissions,
+        _type: "UserTenantAccessPermission",
+      },
+    },
+  };
+}
+
+function loggedInUserProps(): DatabaseCommonInteractionProps {
+  return {
+    ...ownerProps(),
+    userGlobalAccessPermission: {
+      projectIds: [PROJECT_ID],
+      globalPermissions: [Permission.CurrentUser],
+      _type: "UserGlobalAccessPermission",
+    },
+  };
+}
+
+/*
+ * Stands in for Postgres: `save` stamps the generated uuid onto the entity the
+ * way the driver writes it back, and `find` returns a row that has one.
+ */
+function mockRepository(
+  service: unknown,
+  modelType: { new (): BaseModel },
+  rowFields: JSONObject,
+): void {
+  const repository: Record<string, unknown> = {
+    save: async (entity: BaseModel): Promise<BaseModel> => {
+      entity._id = ROW_ID;
+      return entity;
+    },
+    find: async (): Promise<Array<BaseModel>> => {
+      const row: BaseModel = new modelType();
+      row._id = ROW_ID;
+      Object.assign(row, rowFields);
+      return [row];
+    },
+    findOneBy: async (): Promise<null> => {
+      return null;
+    },
+    count: async (): Promise<number> => {
+      return 0;
+    },
+  };
+
+  jest
+    .spyOn(service as never, "getRepository" as never)
+    .mockReturnValue(repository as never);
+}
+
+/* What BaseAPI.createItem used to hand the service: `_id` deleted outright. */
+function payloadWithIdDeleted<T extends BaseModel>(
+  json: JSONObject,
+  modelType: { new (): T },
+): T {
+  const item: T = BaseModel.fromJSON<T>(json, modelType) as T;
+  delete (item as unknown as Record<string, unknown>)["_id"];
+
+  return item;
+}
+
+describe("create and read responses keep their _id", () => {
+  test("a project owner creating and then listing a tenant-scoped model (the incident's shape; the create path's tenant guard already covered this one)", async () => {
+    mockRepository(ProjectSCIMService, ProjectSCIM, { name: "listed scim" });
+
+    const savedItem: ProjectSCIM = await ProjectSCIMService.create({
+      data: payloadWithIdDeleted<ProjectSCIM>(
+        {
+          name: "created scim",
+          projectId: PROJECT_ID.toString(),
+          bearerToken: "scim-token",
+        },
+        ProjectSCIM,
+      ),
+      props: ownerProps(),
+    });
+
+    const createResponse: JSONObject = BaseModel.toJSON(savedItem, ProjectSCIM);
+
+    expect(savedItem._id).toBe(ROW_ID);
+    expect(createResponse["_id"]).toBe(ROW_ID);
+
+    const rows: Array<ProjectSCIM> = await ProjectSCIMService.findBy({
+      query: { projectId: PROJECT_ID },
+      select: { _id: true, name: true } as never,
+      limit: 50,
+      skip: 0,
+      props: ownerProps(),
+    });
+
+    const listResponse: JSONArray = BaseModel.toJSONObjectArray(
+      rows,
+      ProjectSCIM,
+    );
+
+    expect(rows[0]?._id).toBe(ROW_ID);
+    expect((listResponse[0] as JSONObject)["_id"]).toBe(ROW_ID);
+    expect((listResponse[0] as JSONObject)["name"]).toBe("listed scim");
+  });
+
+  test("an isRoot caller creating, then a project owner listing", async () => {
+    /*
+     * isRoot returns from enforceTenantRelationMatchesScalar before it can
+     * warm the column cache, so on master this create was the first thing to
+     * describe the class - and it described it without an id.
+     */
+    mockRepository(ProjectSSOService, ProjectSso, { name: "listed sso" });
+
+    const savedItem: ProjectSso = await ProjectSSOService.create({
+      data: payloadWithIdDeleted<ProjectSso>(
+        {
+          name: "created sso",
+          description: "created by the root caller",
+          projectId: PROJECT_ID.toString(),
+          signatureMethod: "RSA-SHA256",
+          digestMethod: "SHA256",
+          signOnURL: "https://example.com/sso",
+          issuerURL: "https://example.com",
+          publicCertificate: "a-certificate",
+        },
+        ProjectSso,
+      ),
+      props: { isRoot: true },
+    });
+
+    expect(BaseModel.toJSON(savedItem, ProjectSso)["_id"]).toBe(ROW_ID);
+
+    const rows: Array<ProjectSso> = await ProjectSSOService.findBy({
+      query: { projectId: PROJECT_ID },
+      select: { _id: true, name: true } as never,
+      limit: 50,
+      skip: 0,
+      props: ownerProps(),
+    });
+
+    const listResponse: JSONArray = BaseModel.toJSONObjectArray(
+      rows,
+      ProjectSso,
+    );
+
+    expect((listResponse[0] as JSONObject)["_id"]).toBe(ROW_ID);
+  });
+
+  test("a REFUSED create on a model with no tenant column cannot strip ids from later reads", async () => {
+    /*
+     * User.create is `[]` - nobody may POST /api/user - and User has no
+     * @TenantColumn, so neither the permission check nor the tenant guard
+     * stood between the request and the column cache. One authenticated POST
+     * that always 4xxs was enough to strip `_id` from every User response the
+     * process served afterwards.
+     */
+    mockRepository(UserService, User, {
+      email: { _type: "Email", value: "someone@example.com" },
+    });
+
+    await expect(
+      UserService.create({
+        data: payloadWithIdDeleted<User>(
+          { email: "attacker@example.com" },
+          User,
+        ),
+        props: loggedInUserProps(),
+      }),
+    ).rejects.toThrow(/not allowed/i);
+
+    const rows: Array<User> = await UserService.findBy({
+      query: { _id: USER_ID.toString() } as never,
+      select: { _id: true, email: true } as never,
+      limit: 10,
+      skip: 0,
+      props: loggedInUserProps(),
+    });
+
+    const listResponse: JSONArray = BaseModel.toJSONObjectArray(rows, User);
+
+    expect(rows[0]?._id).toBe(ROW_ID);
+    expect((listResponse[0] as JSONObject)["_id"]).toBe(ROW_ID);
+  });
+});

package/Tests/Server/Services/EnterpriseLicenseServiceKeyGeneration.test.ts

@@ -0,0 +1,151 @@
+import EnterpriseLicenseService, {
+  ENTERPRISE_LICENSE_KEY_RANDOM_BYTES,
+  generateEnterpriseLicenseKey,
+} from "../../../Server/Services/EnterpriseLicenseService";
+import { OnCreate } from "../../../Server/Types/Database/Hooks";
+import EnterpriseLicense from "../../../Models/DatabaseModels/EnterpriseLicense";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import crypto from "crypto";
+import { afterEach, describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * License keys are generated on the SERVER when the admin leaves the field
+ * blank. They used to be made in the browser (UUID.generate() in the Admin
+ * Dashboard's create form), so the only randomness guarding a customer's
+ * license came from whatever the admin's browser supplied.
+ *
+ * Pinned: a blank key becomes 32 CSPRNG bytes (64 hex characters, within the
+ * ShortText column), a typed key is kept (trimmed - installations trim what
+ * they send, so stored whitespace would make a key unmatchable), and the hook
+ * runs in onBeforeCreate - before DatabaseService's required-column check,
+ * which would otherwise reject the blank key.
+ */
+
+type RunBeforeCreateFunction = (
+  license: EnterpriseLicense,
+) => Promise<EnterpriseLicense>;
+
+const runBeforeCreate: RunBeforeCreateFunction = async (
+  license: EnterpriseLicense,
+): Promise<EnterpriseLicense> => {
+  const result: OnCreate<EnterpriseLicense> = await (
+    EnterpriseLicenseService as unknown as {
+      onBeforeCreate: (
+        createBy: unknown,
+      ) => Promise<OnCreate<EnterpriseLicense>>;
+    }
+  ).onBeforeCreate({
+    data: license,
+    props: { isRoot: true },
+  });
+
+  return result.createBy.data;
+};
+
+const HEX_KEY: RegExp = /^[0-9a-f]{64}$/;
+
+describe("EnterpriseLicenseService license key generation", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("generateEnterpriseLicenseKey", () => {
+    it("is 32 random bytes written as 64 lower-case hex characters", () => {
+      expect(ENTERPRISE_LICENSE_KEY_RANDOM_BYTES).toBe(32);
+      expect(generateEnterpriseLicenseKey()).toMatch(HEX_KEY);
+    });
+
+    it("fits the licenseKey column", () => {
+      expect(generateEnterpriseLicenseKey().length).toBeLessThanOrEqual(
+        ColumnLength.ShortText,
+      );
+    });
+
+    it("comes from crypto.randomBytes", () => {
+      const randomBytes: ReturnType<typeof jest.spyOn> = jest.spyOn(
+        crypto,
+        "randomBytes",
+      );
+
+      generateEnterpriseLicenseKey();
+
+      expect(randomBytes).toHaveBeenCalledWith(32);
+    });
+
+    it("never repeats", () => {
+      const keys: Set<string> = new Set<string>();
+
+      for (let index: number = 0; index < 500; index++) {
+        keys.add(generateEnterpriseLicenseKey());
+      }
+
+      expect(keys.size).toBe(500);
+    });
+  });
+
+  describe("onBeforeCreate", () => {
+    it("generates a key when the admin left it out entirely", async () => {
+      const license: EnterpriseLicense = BaseModel.fromJSON(
+        { companyName: "Acme, Inc.", expiresAt: "2027-01-01" },
+        EnterpriseLicense,
+      ) as EnterpriseLicense;
+
+      expect((await runBeforeCreate(license)).licenseKey).toMatch(HEX_KEY);
+    });
+
+    it.each([
+      ["an empty string", ""],
+      ["whitespace", "   \t "],
+    ])(
+      "generates a key when the admin submitted %s",
+      async (_label: string, licenseKey: string) => {
+        const license: EnterpriseLicense = new EnterpriseLicense();
+        license.companyName = "Acme, Inc.";
+        license.licenseKey = licenseKey;
+
+        expect((await runBeforeCreate(license)).licenseKey).toMatch(HEX_KEY);
+      },
+    );
+
+    it("keeps a key the admin typed, trimmed", async () => {
+      const license: EnterpriseLicense = new EnterpriseLicense();
+      license.companyName = "Acme, Inc.";
+      license.licenseKey = "  b6f4c1a2-1111-2222-3333-444455556666\n";
+
+      expect((await runBeforeCreate(license)).licenseKey).toBe(
+        "b6f4c1a2-1111-2222-3333-444455556666",
+      );
+    });
+
+    it("gives two blank-key licenses different keys", async () => {
+      const first: EnterpriseLicense = new EnterpriseLicense();
+      const second: EnterpriseLicense = new EnterpriseLicense();
+
+      expect((await runBeforeCreate(first)).licenseKey).not.toBe(
+        (await runBeforeCreate(second)).licenseKey,
+      );
+    });
+
+    it("hands the same create request on, with nothing carried forward", async () => {
+      const license: EnterpriseLicense = new EnterpriseLicense();
+      const createBy: { data: EnterpriseLicense; props: { isRoot: boolean } } =
+        {
+          data: license,
+          props: { isRoot: true },
+        };
+
+      const result: OnCreate<EnterpriseLicense> = await (
+        EnterpriseLicenseService as unknown as {
+          onBeforeCreate: (
+            createBy: unknown,
+          ) => Promise<OnCreate<EnterpriseLicense>>;
+        }
+      ).onBeforeCreate(createBy);
+
+      expect(result.createBy).toBe(createBy);
+      expect(result.createBy.data).toBe(license);
+      expect(result.carryForward).toBeUndefined();
+    });
+  });
+});