@oneuptime/common 14.0.1 → 14.0.2

package/Tests/Server/Infrastructure/Postgres/AddOAuth2WorkflowVariablesMigration.test.ts

@@ -0,0 +1,254 @@
+import { AddOAuth2WorkflowVariables1794300000000 } from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/1794300000000-AddOAuth2WorkflowVariables";
+import SchemaMigrations from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import WorkflowVariable from "../../../../Models/DatabaseModels/WorkflowVariable";
+import ColumnLength from "../../../../Types/Database/ColumnLength";
+import ColumnType from "../../../../Types/Database/ColumnType";
+import { WorkflowVariableType } from "../../../../Types/Workflow/WorkflowVariableOAuth";
+import { describe, expect, test } from "@jest/globals";
+import fs from "fs";
+import path from "path";
+import { QueryRunner, getMetadataArgsStorage } from "typeorm";
+import type { ColumnMetadataArgs } from "typeorm/metadata-args/ColumnMetadataArgs";
+
+/*
+ * The schema half of OAuth 2.0 workflow variables: a type column and the
+ * columns an OAuth variable keeps, on the WorkflowVariable table the initial
+ * migration created.
+ *
+ * It pins that every column is added exactly as the model declares it (a
+ * mismatch is a green deploy followed by a red Schema Drift job), that
+ * existing variables become Static without a backfill, and that down() undoes
+ * up().
+ *
+ * Fake QueryRunner only. Applying every registered migration to an empty
+ * Postgres, then this one, and generating again to "No changes in database
+ * schema were found" is how it was verified; WorkflowVariableOAuthPostgres
+ * exercises the columns against a real database.
+ */
+
+const OWN_CLASS_NAME: string = "AddOAuth2WorkflowVariables1794300000000";
+
+const MIGRATION_PATH: string = path.join(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  "..",
+  "Server",
+  "Infrastructure",
+  "Postgres",
+  "SchemaMigrations",
+  "1794300000000-AddOAuth2WorkflowVariables.ts",
+);
+
+type TimestampOfClassNameFunction = (className: string) => number | null;
+
+const timestampOfClassName: TimestampOfClassNameFunction = (
+  className: string,
+): number | null => {
+  const match: RegExpMatchArray | null = className.match(/(\d{13})$/);
+  return match ? Number(match[1]) : null;
+};
+
+const registeredNames: Array<string> = (
+  SchemaMigrations as unknown as Array<{ name: string }>
+).map((migration: { name: string }): string => {
+  return migration.name;
+});
+
+type RecordQueriesFunction = (
+  direction: "up" | "down",
+) => Promise<Array<string>>;
+
+const recordQueries: RecordQueriesFunction = async (
+  direction: "up" | "down",
+): Promise<Array<string>> => {
+  const statements: Array<string> = [];
+
+  const queryRunner: QueryRunner = {
+    query: async (statement: string): Promise<void> => {
+      statements.push(statement);
+    },
+  } as unknown as QueryRunner;
+
+  await new AddOAuth2WorkflowVariables1794300000000()[direction](queryRunner);
+
+  return statements;
+};
+
+/*
+ * What each column's DDL must be, given the model. character varying(n) is
+ * varchar with a length; text, jsonb and timestamptz carry none.
+ */
+const EXPECTED_COLUMNS: Array<{ property: string; ddl: string }> = [
+  {
+    property: "variableType",
+    ddl: "character varying(100) NOT NULL DEFAULT 'Static'",
+  },
+  { property: "oauthGrantType", ddl: "character varying(100)" },
+  { property: "oauthTokenUrl", ddl: "text" },
+  { property: "oauthClientId", ddl: "character varying(500)" },
+  { property: "oauthClientSecret", ddl: "text" },
+  { property: "oauthRefreshToken", ddl: "text" },
+  { property: "oauthScope", ddl: "text" },
+  { property: "oauthAdditionalParameters", ddl: "jsonb" },
+  {
+    property: "oauthClientAuthenticationMethod",
+    ddl: "character varying(100)",
+  },
+  { property: "oauthAccessToken", ddl: "text" },
+  { property: "oauthAccessTokenExpiresAt", ddl: "TIMESTAMP WITH TIME ZONE" },
+  { property: "oauthLastRefreshedAt", ddl: "TIMESTAMP WITH TIME ZONE" },
+  { property: "oauthLastRefreshError", ddl: "text" },
+  { property: "oauthLastRefreshErrorAt", ddl: "TIMESTAMP WITH TIME ZONE" },
+];
+
+function declaredColumn(property: string): ColumnMetadataArgs {
+  const declared: ColumnMetadataArgs | undefined =
+    getMetadataArgsStorage().columns.find(
+      (column: ColumnMetadataArgs): boolean => {
+        return (
+          column.target === WorkflowVariable && column.propertyName === property
+        );
+      },
+    );
+
+  if (!declared) {
+    throw new Error(`WorkflowVariable declares no column ${property}`);
+  }
+
+  return declared;
+}
+
+const POSTGRES_SPELLING: Record<string, string> = {
+  [ColumnType.ShortText]: "character varying",
+  [ColumnType.VeryLongText]: "text",
+  [ColumnType.JSON]: "jsonb",
+  [ColumnType.Date]: "TIMESTAMP WITH TIME ZONE",
+};
+
+describe("AddOAuth2WorkflowVariables migration - identity and registration", () => {
+  test("lives at its round stamp, with a class and name that carry it", () => {
+    const source: string = fs.readFileSync(MIGRATION_PATH, "utf8");
+
+    expect(source).toContain(`export class ${OWN_CLASS_NAME}`);
+    expect(source).toContain(`public name: string = "${OWN_CLASS_NAME}";`);
+    expect(new AddOAuth2WorkflowVariables1794300000000().name).toBe(
+      OWN_CLASS_NAME,
+    );
+  });
+
+  test("is registered, so the columns actually reach every database", () => {
+    expect(registeredNames).toContain(OWN_CLASS_NAME);
+  });
+
+  test("its timestamp keeps it behind every migration registered before it", () => {
+    const ownIndex: number = registeredNames.indexOf(OWN_CLASS_NAME);
+
+    expect(ownIndex).toBeGreaterThan(0);
+
+    const ownTimestamp: number = timestampOfClassName(OWN_CLASS_NAME)!;
+
+    const notBehind: Array<string> = registeredNames
+      .slice(0, ownIndex)
+      .filter((className: string): boolean => {
+        const timestamp: number | null = timestampOfClassName(className);
+        return timestamp !== null && timestamp >= ownTimestamp;
+      });
+
+    expect(notBehind).toEqual([]);
+  });
+});
+
+describe("AddOAuth2WorkflowVariables migration - up()", () => {
+  test("adds exactly the new columns, in order, and nothing else", async () => {
+    expect(await recordQueries("up")).toEqual(
+      EXPECTED_COLUMNS.map((column: { property: string; ddl: string }) => {
+        return `ALTER TABLE "WorkflowVariable" ADD "${column.property}" ${column.ddl}`;
+      }),
+    );
+  });
+
+  test("adds every column the model declares that the table did not have", async () => {
+    const added: Array<string> = EXPECTED_COLUMNS.map(
+      (column: { property: string }) => {
+        return column.property;
+      },
+    );
+
+    const modelColumns: Array<string> = getMetadataArgsStorage()
+      .columns.filter((column: ColumnMetadataArgs): boolean => {
+        return (
+          column.target === WorkflowVariable &&
+          (column.propertyName.startsWith("oauth") ||
+            column.propertyName === "variableType")
+        );
+      })
+      .map((column: ColumnMetadataArgs): string => {
+        return column.propertyName;
+      });
+
+    expect([...modelColumns].sort()).toEqual([...added].sort());
+  });
+
+  test.each(EXPECTED_COLUMNS)(
+    "$property matches the column the model declares",
+    ({ property, ddl }: { property: string; ddl: string }) => {
+      const declared: ColumnMetadataArgs = declaredColumn(property);
+      const type: string = String(declared.options.type);
+
+      expect(declared.options.name).toBeUndefined();
+      expect(ddl.startsWith(POSTGRES_SPELLING[type] || "unknown")).toBe(true);
+
+      if (declared.options.length) {
+        expect(ddl).toContain(`(${declared.options.length})`);
+      }
+
+      if (property === "variableType") {
+        expect(declared.options.nullable).toBe(false);
+        expect(declared.options.default).toBe(WorkflowVariableType.Static);
+        expect(ddl).toContain("NOT NULL");
+      } else {
+        expect(declared.options.nullable).toBe(true);
+        expect(declared.options.default).toBeUndefined();
+        expect(ddl).not.toContain("NOT NULL");
+      }
+    },
+  );
+
+  test("uses the lengths ColumnLength defines", () => {
+    expect(ColumnLength.ShortText).toBe(100);
+    expect(ColumnLength.LongText).toBe(500);
+    expect(declaredColumn("oauthClientId").options.type).toBe(
+      ColumnType.LongText,
+    );
+  });
+
+  /*
+   * Every variable saved before this migration is a Static variable, and the
+   * NOT NULL DEFAULT makes it one in the same statement - no backfill, no
+   * window in which a row has no type.
+   */
+  test("turns every existing variable into a Static one without a backfill", async () => {
+    const statements: Array<string> = await recordQueries("up");
+
+    expect(statements[0]).toBe(
+      `ALTER TABLE "WorkflowVariable" ADD "variableType" character varying(100) NOT NULL DEFAULT '${WorkflowVariableType.Static}'`,
+    );
+    expect(
+      statements.some((statement: string) => {
+        return statement.startsWith("UPDATE");
+      }),
+    ).toBe(false);
+  });
+});
+
+describe("AddOAuth2WorkflowVariables migration - down()", () => {
+  test("drops exactly the columns up() added, in reverse order", async () => {
+    expect(await recordQueries("down")).toEqual(
+      [...EXPECTED_COLUMNS].reverse().map((column: { property: string }) => {
+        return `ALTER TABLE "WorkflowVariable" DROP COLUMN "${column.property}"`;
+      }),
+    );
+  });
+});

package/Tests/Server/Middleware/BlockedUserMiddleware.test.ts

@@ -0,0 +1,403 @@
+import MasterAdminAuthorization from "../../../Server/Middleware/MasterAdminAuthorization";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import AccessTokenService from "../../../Server/Services/AccessTokenService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import UserService from "../../../Server/Services/UserService";
+import {
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import JSONWebToken from "../../../Server/Utils/JsonWebToken";
+import logger from "../../../Server/Utils/Logger";
+import Response from "../../../Server/Utils/Response";
+import Dictionary from "../../../Types/Dictionary";
+import Email from "../../../Types/Email";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionMessages from "../../../Types/Exception/ExceptionMessages";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import ServerException from "../../../Types/Exception/ServerException";
+import Name from "../../../Types/Name";
+import ObjectID from "../../../Types/ObjectID";
+import { UserGlobalAccessPermission } from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { getJestSpyOn } from "../../Spy";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * A BLOCKED USER'S ACCESS TOKEN STOPS WORKING, NOT JUST THEIR NEXT SIGN-IN.
+ *
+ * Access tokens are stateless JWTs that live for 15 minutes. Blocking a user
+ * revokes their sessions, which stops /refresh-token from minting new ones,
+ * but it cannot recall a token already in the browser. Before the request
+ * middlewares consulted `User.isBlocked`, a user blocked by a master admin
+ * kept full access -- including, for a master admin, every master-admin
+ * route -- until that token ran out.
+ *
+ * Tokens are signed and decoded with the real JSONWebToken, so a "valid
+ * token" here is one production would accept. UserService.isUserBlocked is
+ * stubbed: its caching is UserServiceBlockedUser.test.ts.
+ */
+
+const USER_ID: ObjectID = new ObjectID("44444444-4444-4444-8444-444444444444");
+
+type SignValidTokenFunction = (data?: { isMasterAdmin?: boolean }) => string;
+
+const signValidToken: SignValidTokenFunction = (data?: {
+  isMasterAdmin?: boolean;
+}): string => {
+  return JSONWebToken.signUserLoginToken({
+    tokenData: {
+      userId: USER_ID,
+      email: new Email("blocked.user@example.com"),
+      name: new Name("Blocked User"),
+      timezone: null,
+      isMasterAdmin: Boolean(data?.isMasterAdmin),
+      isGlobalLogin: true,
+      sessionId: ObjectID.generate(),
+    },
+    expiresInSeconds: 15 * 60,
+  });
+};
+
+type BuildRequestFunction = (data: {
+  cookies?: Dictionary<string>;
+  headers?: Dictionary<string>;
+}) => OneUptimeRequest;
+
+// No tenant, so the permission path stays on the global lookup.
+const buildRequest: BuildRequestFunction = (data: {
+  cookies?: Dictionary<string>;
+  headers?: Dictionary<string>;
+}): OneUptimeRequest => {
+  return {
+    params: {},
+    query: {},
+    body: {},
+    cookies: data.cookies || {},
+    headers: { tenantid: "", ...(data.headers || {}) },
+  } as unknown as OneUptimeRequest;
+};
+
+type MiddlewareFunction = (
+  req: OneUptimeRequest,
+  res: ExpressResponse,
+  next: NextFunction,
+) => Promise<void>;
+
+type MiddlewareCallResult = {
+  nextCalls: Array<Array<unknown>>;
+  sentError: Exception | undefined;
+  sendErrorCallCount: number;
+};
+
+type CallMiddlewareFunction = (
+  middleware: MiddlewareFunction,
+  req: OneUptimeRequest,
+) => Promise<MiddlewareCallResult>;
+
+const callMiddleware: CallMiddlewareFunction = async (
+  middleware: MiddlewareFunction,
+  req: OneUptimeRequest,
+): Promise<MiddlewareCallResult> => {
+  const res: ExpressResponse = { set: jest.fn() } as unknown as ExpressResponse;
+  const next: jest.Mock = jest.fn();
+
+  await middleware(req, res, next as unknown as NextFunction);
+
+  const errorCalls: Array<Array<unknown>> = (
+    Response.sendErrorResponse as unknown as jest.Mock
+  ).mock.calls as Array<Array<unknown>>;
+
+  return {
+    nextCalls: next.mock.calls as Array<Array<unknown>>,
+    sentError: errorCalls[0]?.[2] as Exception | undefined,
+    sendErrorCallCount: errorCalls.length,
+  };
+};
+
+type ExpectBlockedRefusalFunction = (result: MiddlewareCallResult) => void;
+
+/*
+ * A 401 specifically: the browser client answers a 401 by asking
+ * /refresh-token for a new session, which is refused for a blocked user, and
+ * that refusal is what signs them out. A 422 would leave a dead dashboard.
+ */
+const expectBlockedRefusal: ExpectBlockedRefusalFunction = (
+  result: MiddlewareCallResult,
+): void => {
+  expect(result.nextCalls).toHaveLength(0);
+  expect(result.sendErrorCallCount).toBe(1);
+  expect(result.sentError).toBeInstanceOf(NotAuthenticatedException);
+  expect(result.sentError?.code).toBe(401);
+  expect(result.sentError?.message).toBe(ExceptionMessages.UserBlocked);
+};
+
+const GLOBAL_PERMISSION: UserGlobalAccessPermission = {
+  _type: "UserGlobalAccessPermission",
+  projectIds: [],
+  globalPermissions: [],
+};
+
+let isUserBlocked: jest.SpyInstance;
+let getUserGlobalAccessPermission: jest.SpyInstance;
+let userUpdateLastActive: jest.SpyInstance;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+
+  getJestSpyOn(Response, "sendErrorResponse").mockImplementation(() => {
+    return undefined as never;
+  });
+  getJestSpyOn(logger, "error").mockImplementation(() => {
+    return undefined;
+  });
+
+  isUserBlocked = getJestSpyOn(UserService, "isUserBlocked").mockResolvedValue(
+    false,
+  );
+  getUserGlobalAccessPermission = getJestSpyOn(
+    AccessTokenService,
+    "getUserGlobalAccessPermission",
+  ).mockResolvedValue(GLOBAL_PERMISSION);
+  userUpdateLastActive = getJestSpyOn(
+    UserService,
+    "updateLastActive",
+  ).mockResolvedValue(undefined);
+  getJestSpyOn(ProjectService, "updateLastActive").mockResolvedValue(undefined);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("UserMiddleware.getUserMiddleware — a blocked user's live access token", () => {
+  test("is refused with a 401 from the access-token cookie", async () => {
+    isUserBlocked.mockResolvedValue(true);
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      UserMiddleware.getUserMiddleware as MiddlewareFunction,
+      buildRequest({ cookies: { "user-token": signValidToken() } }),
+    );
+
+    expectBlockedRefusal(result);
+    expect(isUserBlocked).toHaveBeenCalledWith(USER_ID);
+  });
+
+  // The mobile app's transport.
+  test("is refused with a 401 from an Authorization: Bearer header", async () => {
+    isUserBlocked.mockResolvedValue(true);
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      UserMiddleware.getUserMiddleware as MiddlewareFunction,
+      buildRequest({
+        headers: { authorization: `Bearer ${signValidToken()}` },
+      }),
+    );
+
+    expectBlockedRefusal(result);
+  });
+
+  test("is refused for a master admin too", async () => {
+    isUserBlocked.mockResolvedValue(true);
+
+    const req: OneUptimeRequest = buildRequest({
+      cookies: { "user-token": signValidToken({ isMasterAdmin: true }) },
+    });
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      UserMiddleware.getUserMiddleware as MiddlewareFunction,
+      req,
+    );
+
+    expectBlockedRefusal(result);
+    expect(req.userType).not.toBe(UserType.MasterAdmin);
+  });
+
+  test("resolves no permissions and records no activity for the refused request", async () => {
+    isUserBlocked.mockResolvedValue(true);
+
+    const req: OneUptimeRequest = buildRequest({
+      cookies: { "user-token": signValidToken() },
+    });
+
+    await callMiddleware(
+      UserMiddleware.getUserMiddleware as MiddlewareFunction,
+      req,
+    );
+
+    expect(getUserGlobalAccessPermission).not.toHaveBeenCalled();
+    expect(userUpdateLastActive).not.toHaveBeenCalled();
+    expect(req.userGlobalAccessPermission).toBeUndefined();
+  });
+
+  test("still lets a user who is not blocked through", async () => {
+    const req: OneUptimeRequest = buildRequest({
+      cookies: { "user-token": signValidToken() },
+    });
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      UserMiddleware.getUserMiddleware as MiddlewareFunction,
+      req,
+    );
+
+    expect(result.sendErrorCallCount).toBe(0);
+    expect(result.nextCalls).toEqual([[]]);
+    expect(req.userType).toBe(UserType.User);
+    expect(req.userAuthorization?.userId.toString()).toBe(USER_ID.toString());
+    expect(isUserBlocked).toHaveBeenCalledWith(USER_ID);
+  });
+
+  // "We could not find out" is not "not blocked".
+  test("refuses the request when the blocked-status lookup fails", async () => {
+    const lookupFailure: ServerException = new ServerException(
+      "database unavailable",
+    );
+    isUserBlocked.mockRejectedValue(lookupFailure);
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      UserMiddleware.getUserMiddleware as MiddlewareFunction,
+      buildRequest({ cookies: { "user-token": signValidToken() } }),
+    );
+
+    expect(result.nextCalls).toHaveLength(0);
+    expect(result.sendErrorCallCount).toBe(1);
+    expect(result.sentError).toBe(lookupFailure);
+  });
+
+  test("is not consulted for a request with no access token", async () => {
+    const result: MiddlewareCallResult = await callMiddleware(
+      UserMiddleware.getUserMiddleware as MiddlewareFunction,
+      buildRequest({}),
+    );
+
+    expect(result.nextCalls).toEqual([[]]);
+    expect(isUserBlocked).not.toHaveBeenCalled();
+  });
+});
+
+describe("UserMiddleware.getPublicRouteUserMiddleware — a blocked user's live access token", () => {
+  /*
+   * The public dashboard and status page routes never read the caller's
+   * identity and cannot refresh a dashboard session, so a 401 there is a
+   * reload loop. The blocked user is served exactly as an anonymous visitor.
+   */
+  test("is served anonymously rather than refused", async () => {
+    isUserBlocked.mockResolvedValue(true);
+
+    const req: OneUptimeRequest = buildRequest({
+      cookies: { "user-token": signValidToken() },
+    });
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+      req,
+    );
+
+    expect(result.sendErrorCallCount).toBe(0);
+    expect(result.nextCalls).toEqual([[]]);
+    expect(req.userType).toBe(UserType.Public);
+    expect(req.userAuthorization).toBeUndefined();
+    expect(UserMiddleware.isAnonymousRequest(req)).toBe(true);
+    expect(getUserGlobalAccessPermission).not.toHaveBeenCalled();
+  });
+
+  test("leaves a request that requireUserAuthentication still refuses", async () => {
+    isUserBlocked.mockResolvedValue(true);
+
+    const req: OneUptimeRequest = buildRequest({
+      cookies: { "user-token": signValidToken() },
+    });
+
+    await callMiddleware(
+      UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+      req,
+    );
+
+    (Response.sendErrorResponse as unknown as jest.Mock).mockClear();
+
+    const guarded: MiddlewareCallResult = await callMiddleware(
+      UserMiddleware.requireUserAuthentication as MiddlewareFunction,
+      req,
+    );
+
+    expect(guarded.nextCalls).toHaveLength(0);
+    expect(guarded.sentError).toBeInstanceOf(NotAuthenticatedException);
+  });
+});
+
+describe("MasterAdminAuthorization — a blocked master admin's live access token", () => {
+  /*
+   * The master-admin routes decode the JWT themselves instead of going
+   * through getUserMiddleware, so they need the check of their own.
+   */
+  test("is refused with a 401 by isAuthorizedMasterAdminMiddleware", async () => {
+    isUserBlocked.mockResolvedValue(true);
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware as unknown as MiddlewareFunction,
+      buildRequest({
+        cookies: { "user-token": signValidToken({ isMasterAdmin: true }) },
+      }),
+    );
+
+    expectBlockedRefusal(result);
+    expect(isUserBlocked).toHaveBeenCalledWith(USER_ID);
+  });
+
+  test("is refused with a 401 by isAuthorizedMasterAdminOrMasterApiKeyMiddleware", async () => {
+    isUserBlocked.mockResolvedValue(true);
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      MasterAdminAuthorization.isAuthorizedMasterAdminOrMasterApiKeyMiddleware as unknown as MiddlewareFunction,
+      buildRequest({
+        cookies: { "user-token": signValidToken({ isMasterAdmin: true }) },
+      }),
+    );
+
+    expectBlockedRefusal(result);
+  });
+
+  test("still lets a master admin who is not blocked through", async () => {
+    const result: MiddlewareCallResult = await callMiddleware(
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware as unknown as MiddlewareFunction,
+      buildRequest({
+        cookies: { "user-token": signValidToken({ isMasterAdmin: true }) },
+      }),
+    );
+
+    expect(result.sendErrorCallCount).toBe(0);
+    expect(result.nextCalls).toEqual([[]]);
+  });
+
+  // A lookup failure is reported as itself, not as an invalid token the client should refresh.
+  test("reports a failed lookup as that failure, not as an invalid token", async () => {
+    const lookupFailure: ServerException = new ServerException(
+      "database unavailable",
+    );
+    isUserBlocked.mockRejectedValue(lookupFailure);
+
+    const result: MiddlewareCallResult = await callMiddleware(
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware as unknown as MiddlewareFunction,
+      buildRequest({
+        cookies: { "user-token": signValidToken({ isMasterAdmin: true }) },
+      }),
+    );
+
+    expect(result.nextCalls).toHaveLength(0);
+    expect(result.sendErrorCallCount).toBe(1);
+    expect(result.sentError).toBe(lookupFailure);
+  });
+
+  // Not a master admin at all: refused as before, without a lookup.
+  test("does not look up a caller that is refused as not a master admin", async () => {
+    const result: MiddlewareCallResult = await callMiddleware(
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware as unknown as MiddlewareFunction,
+      buildRequest({ cookies: { "user-token": signValidToken() } }),
+    );
+
+    expect(result.nextCalls).toHaveLength(0);
+    expect(result.sentError?.code).toBe(422);
+    expect(isUserBlocked).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Middleware/MasterAdminAuthorization.test.ts

@@ -1,6 +1,7 @@
 import MasterAdminAuthorization from "../../../Server/Middleware/MasterAdminAuthorization";
 import ProjectMiddleware from "../../../Server/Middleware/ProjectAuthorization";
 import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import UserService from "../../../Server/Services/UserService";
 import CookieUtil from "../../../Server/Utils/Cookie";
 import JSONWebToken from "../../../Server/Utils/JsonWebToken";
 import Response from "../../../Server/Utils/Response";
@@ -159,6 +160,12 @@ describe("MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware", () => {
     decodeSpy = getJestSpyOn(JSONWebToken, "decode").mockImplementation(() => {
       throw new BadDataException("AccessToken is invalid or expired");
     });
+
+    /*
+     * Blocked users are refused by these middlewares too; that is
+     * BlockedUserMiddleware.test.ts. Here every session is not blocked.
+     */
+    getJestSpyOn(UserService, "isUserBlocked").mockResolvedValue(false);
   });
 
   describe("when there is no access token (the expired-cookie case)", () => {
@@ -337,6 +344,12 @@ describe("MasterAdminAuthorization.isAuthorizedMasterAdminOrMasterApiKeyMiddlewa
     ): Promise<boolean> => {
       return Promise.resolve(apiKey.toString() === MASTER_API_KEY);
     }) as never);
+
+    /*
+     * Blocked users are refused by these middlewares too; that is
+     * BlockedUserMiddleware.test.ts. Here every session is not blocked.
+     */
+    getJestSpyOn(UserService, "isUserBlocked").mockResolvedValue(false);
   });
 
   describe("when the master API key is presented", () => {

package/Tests/Server/Middleware/PublicRouteUserMiddleware.test.ts

@@ -242,6 +242,8 @@ beforeEach(() => {
     "updateLastActive",
   ).mockResolvedValue(undefined);
   getJestSpyOn(ProjectService, "updateLastActive").mockResolvedValue(undefined);
+  // A blocked user's token is BlockedUserMiddleware.test.ts; here nobody is blocked.
+  getJestSpyOn(UserService, "isUserBlocked").mockResolvedValue(false);
 });
 
 afterEach(() => {