@oneuptime/common 14.0.13 → 14.0.14

package/Tests/Server/API/StatusPagesListingMonitorsRoute.test.ts

@@ -0,0 +1,286 @@
+import { mockRouter } from "./Helpers";
+import CommonAPI from "../../../Server/API/CommonAPI";
+import StatusPageAPI from "../../../Server/API/StatusPageAPI";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import StatusPagesListingMonitorsBuilder, {
+  StatusPagesListingMonitorsRequest,
+} from "../../../Server/Utils/StatusPage/StatusPagesListingMonitorsBuilder";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Dictionary from "../../../Types/Dictionary";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import StatusPageEventType from "../../../Types/StatusPage/StatusPageEventType";
+import StatusPagesListingMonitors, {
+  StatusPagesListingMonitorsResult,
+} from "../../../Types/StatusPage/StatusPagesListingMonitors";
+import UserType from "../../../Types/UserType";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * The route's own part of POST /status-page/listing-monitors: where it is,
+ * what guards it, who it admits and what it hands the builder. What the
+ * answer holds, through the real permission layer, is
+ * StatusPagesListingMonitorsAPI.test.ts; the builder on its own is
+ * Utils/StatusPage/StatusPagesListingMonitorsBuilder.test.ts.
+ */
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendJsonObjectResponse: jest.fn(),
+    sendEntityArrayResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+    sendFileResponse: jest.fn(),
+    sendTextResponse: jest.fn(),
+    setNoCacheHeaders: jest.fn(),
+  };
+});
+
+const ROUTE: string = "/status-page/listing-monitors";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "10000000-0000-4000-8000-000000000001",
+);
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "10000000-0000-4000-8000-000000000002",
+);
+const MONITOR_ID: string = "c0000000-0000-4000-8000-000000000001";
+const PAGE_ID: string = "b0000000-0000-4000-8000-000000000001";
+
+let callerProps: DatabaseCommonInteractionProps;
+let build: MockFunction;
+
+function tenantPermissions(
+  projectId: ObjectID,
+): Dictionary<UserTenantAccessPermission> {
+  return {
+    [projectId.toString()]: {
+      _type: "UserTenantAccessPermission",
+      projectId: projectId,
+      permissions: [
+        {
+          _type: "UserPermission",
+          permission: Permission.ProjectMember,
+          labelIds: [],
+          isBlockPermission: false,
+        },
+      ],
+    } as UserTenantAccessPermission,
+  };
+}
+
+interface RouteCall {
+  thrown: unknown;
+  sent: JSONObject | undefined;
+}
+
+async function post(body: unknown): Promise<RouteCall> {
+  const req: ExpressRequest = {
+    params: {},
+    query: {},
+    body: body,
+    headers: {},
+  } as unknown as ExpressRequest;
+
+  const res: ExpressResponse = {} as ExpressResponse;
+  const next: MockFunction = getJestMockFunction();
+
+  await mockRouter
+    .match("post", ROUTE)
+    .handlerFunction(req, res, next as unknown as NextFunction);
+
+  const send: jest.Mock =
+    Response.sendJsonObjectResponse as unknown as jest.Mock;
+
+  return {
+    thrown: next.mock.calls[0] ? next.mock.calls[0][0] : undefined,
+    sent: send.mock.calls[0]
+      ? (send.mock.calls[0][2] as JSONObject)
+      : undefined,
+  };
+}
+
+function builtRequest(): StatusPagesListingMonitorsRequest {
+  expect(build).toHaveBeenCalledTimes(1);
+  return build.mock.calls[0]![0] as StatusPagesListingMonitorsRequest;
+}
+
+beforeAll(() => {
+  mockRouter.routes.length = 0;
+  new StatusPageAPI();
+});
+
+beforeEach(() => {
+  jest.clearAllMocks();
+
+  callerProps = {
+    userId: new ObjectID("20000000-0000-4000-8000-000000000001"),
+    userType: UserType.User,
+    tenantId: PROJECT_ID,
+    userTenantAccessPermission: tenantPermissions(PROJECT_ID),
+  };
+
+  jest
+    .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+    .mockImplementation((() => {
+      return Promise.resolve(callerProps);
+    }) as never);
+
+  build = getJestMockFunction();
+  build.mockImplementation((): Promise<StatusPagesListingMonitorsResult> => {
+    return Promise.resolve({
+      statusPages: [{ statusPageId: PAGE_ID, name: "Acme Public" }],
+    });
+  });
+  jest
+    .spyOn(StatusPagesListingMonitorsBuilder, "build")
+    .mockImplementation(build as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("POST /status-page/listing-monitors, the route", () => {
+  test("is registered once, behind the session and the expired-session guard", () => {
+    const registrations: Array<ReturnType<typeof mockRouter.match>> =
+      mockRouter.routes.filter(
+        (route: ReturnType<typeof mockRouter.match>): boolean => {
+          return route.method === "POST" && route.uri === ROUTE;
+        },
+      );
+
+    expect(registrations).toHaveLength(1);
+    expect(registrations[0]!.middlewares).toEqual([
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+    ]);
+  });
+
+  test("the path is the one the dashboard calls", () => {
+    expect(StatusPagesListingMonitors.apiPath).toBe(ROUTE);
+  });
+
+  test("answers a member with the builder's answer, and no-cache headers", async () => {
+    const call: RouteCall = await post({
+      monitorIds: [MONITOR_ID],
+      eventType: StatusPageEventType.ScheduledEvent,
+    });
+
+    expect(call.thrown).toBeUndefined();
+    expect(call.sent).toEqual({
+      statusPages: [{ statusPageId: PAGE_ID, name: "Acme Public" }],
+    });
+    expect(Response.setNoCacheHeaders).toHaveBeenCalledTimes(1);
+
+    const request: StatusPagesListingMonitorsRequest = builtRequest();
+
+    expect(request.projectId.toString()).toBe(PROJECT_ID.toString());
+    expect(
+      request.monitorIds.map((id: ObjectID): string => {
+        return id.toString();
+      }),
+    ).toEqual([MONITOR_ID]);
+    expect(request.eventType).toBe(StatusPageEventType.ScheduledEvent);
+  });
+
+  test("hands the builder the caller's own permissions, for one project, never root", async () => {
+    callerProps = { ...callerProps, isMultiTenantRequest: true };
+
+    await post({ monitorIds: [MONITOR_ID] });
+
+    const props: DatabaseCommonInteractionProps = builtRequest().props;
+
+    expect(props.isRoot).toBeFalsy();
+    expect(props.isMultiTenantRequest).toBe(false);
+    expect(props.userId?.toString()).toBe(callerProps.userId?.toString());
+    expect(props.userTenantAccessPermission).toBe(
+      callerProps.userTenantAccessPermission,
+    );
+  });
+
+  test("admits a project API key: its own permissions bound what it learns", async () => {
+    callerProps = {
+      userType: UserType.API,
+      tenantId: PROJECT_ID,
+      userTenantAccessPermission: tenantPermissions(PROJECT_ID),
+    };
+
+    const call: RouteCall = await post({ monitorIds: [MONITOR_ID] });
+
+    expect(call.thrown).toBeUndefined();
+    expect(call.sent).toBeDefined();
+    expect(builtRequest().props.userType).toBe(UserType.API);
+  });
+
+  test("refuses a caller who is not in the project named in the tenant header", async () => {
+    callerProps = {
+      ...callerProps,
+      userTenantAccessPermission: tenantPermissions(OTHER_PROJECT_ID),
+    };
+
+    const call: RouteCall = await post({ monitorIds: [MONITOR_ID] });
+
+    expect(call.thrown).toBeInstanceOf(NotAuthorizedException);
+    expect(build).not.toHaveBeenCalled();
+    expect(call.sent).toBeUndefined();
+  });
+
+  test("asks for the project when the tenant header is missing", async () => {
+    callerProps = { ...callerProps, tenantId: undefined };
+
+    const call: RouteCall = await post({ monitorIds: [MONITOR_ID] });
+
+    expect(call.thrown).toBeInstanceOf(BadDataException);
+    expect(build).not.toHaveBeenCalled();
+  });
+
+  test("an expired session is told to sign in again (401), not refused", async () => {
+    callerProps = {
+      userType: UserType.Public,
+      tenantId: PROJECT_ID,
+    };
+
+    const call: RouteCall = await post({ monitorIds: [MONITOR_ID] });
+
+    expect(call.thrown).toBeInstanceOf(NotAuthenticatedException);
+    expect(build).not.toHaveBeenCalled();
+  });
+
+  test("a malformed request is refused before anything is read", async () => {
+    const call: RouteCall = await post({ monitorIds: "all" });
+
+    expect(call.thrown).toBeInstanceOf(BadDataException);
+    expect(build).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Infrastructure/GlobalCache.test.ts

@@ -103,6 +103,162 @@ describe("GlobalCache.setString", () => {
   });
 });
 
+describe("GlobalCache.incrementWithExpiry", () => {
+  let client: MockClient;
+
+  beforeEach(() => {
+    client = {
+      set: jest.fn().mockResolvedValue("OK"),
+      expire: jest.fn().mockResolvedValue(1),
+      get: jest.fn(),
+      del: jest.fn().mockResolvedValue(1),
+      eval: jest.fn().mockResolvedValue(3),
+    };
+    (Redis.getClient as jest.Mock).mockReturnValue(client);
+    (Redis.isConnected as jest.Mock).mockReturnValue(true);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  /*
+   * INCR and the first EXPIRE in one evaluation: a separate EXPIRE after
+   * the INCR can be lost to a crash in between, leaving a counter that
+   * never expires.
+   */
+  test("adds one and sets the expiry in one atomic EVAL, returning the count", async () => {
+    const count: number = await GlobalCache.incrementWithExpiry("ns", "key", {
+      expiresInSeconds: 1800,
+    });
+
+    expect(count).toBe(3);
+    expect(client.eval).toHaveBeenCalledTimes(1);
+
+    const [script, keyCount, key, ttl] = client.eval.mock.calls[0] as [
+      string,
+      number,
+      string,
+      string,
+    ];
+
+    expect(script).toContain("INCR");
+    expect(script).toContain("EXPIRE");
+    expect(keyCount).toBe(1);
+    expect(key).toBe("ns-key");
+    expect(ttl).toBe("1800");
+    expect(client.expire).not.toHaveBeenCalled();
+  });
+
+  test("throws on a reply that is not a number", async () => {
+    client.eval.mockResolvedValue("not a number");
+
+    await expect(
+      GlobalCache.incrementWithExpiry("ns", "key", { expiresInSeconds: 60 }),
+    ).rejects.toThrow();
+  });
+
+  test("throws when the cache is not connected", async () => {
+    (Redis.isConnected as jest.Mock).mockReturnValue(false);
+
+    await expect(
+      GlobalCache.incrementWithExpiry("ns", "key", { expiresInSeconds: 60 }),
+    ).rejects.toThrow(DatabaseNotConnectedException);
+    expect(client.eval).not.toHaveBeenCalled();
+  });
+});
+
+describe("GlobalCache.incrementIfBelow", () => {
+  let client: MockClient;
+
+  beforeEach(() => {
+    client = {
+      set: jest.fn().mockResolvedValue("OK"),
+      expire: jest.fn().mockResolvedValue(1),
+      get: jest.fn(),
+      del: jest.fn().mockResolvedValue(1),
+      eval: jest.fn().mockResolvedValue(4),
+    };
+    (Redis.getClient as jest.Mock).mockReturnValue(client);
+    (Redis.isConnected as jest.Mock).mockReturnValue(true);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  /*
+   * The read, the comparison, the INCR and the first EXPIRE in one atomic
+   * evaluation: a GET then an INCR from here would let two callers both see
+   * room for one more, and a refusal must add nothing, so that callers with
+   * a lower limit cannot use up what callers with a higher one may still
+   * take from the same counter.
+   */
+  test("compares, adds one and sets the expiry in one atomic EVAL, returning the count", async () => {
+    const count: number | null = await GlobalCache.incrementIfBelow(
+      "ns",
+      "key",
+      { limit: 12, expiresInSeconds: 1800 },
+    );
+
+    expect(count).toBe(4);
+    expect(client.eval).toHaveBeenCalledTimes(1);
+
+    const [script, keyCount, key, limit, ttl] = client.eval.mock.calls[0] as [
+      string,
+      number,
+      string,
+      string,
+      string,
+    ];
+
+    expect(script).toContain("GET");
+    expect(script).toContain(">= tonumber(ARGV[1])");
+    expect(script).toContain("INCR");
+    expect(script).toContain("EXPIRE");
+    expect(script.indexOf("return -1")).toBeLessThan(script.indexOf("INCR"));
+    expect(keyCount).toBe(1);
+    expect(key).toBe("ns-key");
+    expect(limit).toBe("12");
+    expect(ttl).toBe("1800");
+    expect(client.expire).not.toHaveBeenCalled();
+  });
+
+  test("answers null when the counter has reached its limit", async () => {
+    client.eval.mockResolvedValue(-1);
+
+    expect(
+      await GlobalCache.incrementIfBelow("ns", "key", {
+        limit: 12,
+        expiresInSeconds: 60,
+      }),
+    ).toBeNull();
+  });
+
+  test("throws on a reply that is not a number", async () => {
+    client.eval.mockResolvedValue("not a number");
+
+    await expect(
+      GlobalCache.incrementIfBelow("ns", "key", {
+        limit: 1,
+        expiresInSeconds: 60,
+      }),
+    ).rejects.toThrow();
+  });
+
+  test("throws when the cache is not connected", async () => {
+    (Redis.isConnected as jest.Mock).mockReturnValue(false);
+
+    await expect(
+      GlobalCache.incrementIfBelow("ns", "key", {
+        limit: 1,
+        expiresInSeconds: 60,
+      }),
+    ).rejects.toThrow(DatabaseNotConnectedException);
+    expect(client.eval).not.toHaveBeenCalled();
+  });
+});
+
 describe("GlobalCache.deleteKey", () => {
   let client: MockClient;
 

package/Tests/Server/Infrastructure/Postgres/MigrateIncidentFormsToFormsMigration.test.ts

@@ -1,4 +1,5 @@
 import { AddIncidentForms1796400000000 } from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/1796400000000-AddIncidentForms";
+import { AddFormBranding1797700000000 } from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/1797700000000-AddFormBranding";
 import {
   LEGACY_PERMISSION_RENAMES,
   MigrateIncidentFormsToForms1797400000000,
@@ -19,6 +20,7 @@ import fs from "fs";
 import path from "path";
 import {
   DefaultNamingStrategy,
+  MigrationInterface,
   QueryRunner,
   getMetadataArgsStorage,
 } from "typeorm";
@@ -205,6 +207,31 @@ function persistedColumns(modelType: unknown): Array<string> {
   return names;
 }
 
+/*
+ * Columns a later migration added to the tables this one creates, by the
+ * migration that added them: this CREATE TABLE never had them.
+ */
+const ADDED_LATER: Array<{
+  migration: MigrationInterface;
+  table: string;
+  columns: Array<string>;
+}> = [
+  {
+    // A form's branding: its logo, what the logo says, its favicon.
+    migration: new AddFormBranding1797700000000(),
+    table: "Form",
+    columns: ["logoFileId", "logoAltText", "faviconFileId"],
+  },
+];
+
+function addedLater(table: string, column: string): boolean {
+  return ADDED_LATER.some(
+    (entry: { table: string; columns: Array<string> }): boolean => {
+      return entry.table === table && entry.columns.includes(column);
+    },
+  );
+}
+
 function formInserts(recorded: Array<Recorded>): Array<Recorded> {
   return recorded.filter((entry: Recorded): boolean => {
     return entry.statement.startsWith('INSERT INTO "Form" (');
@@ -280,7 +307,31 @@ describe("MigrateIncidentFormsToForms migration - up(): the schema", () => {
           table,
           column,
           created: create!.includes(`"${column}"`),
-        }).toEqual({ table, column, created: true });
+        }).toEqual({ table, column, created: !addedLater(table, column) });
+      }
+    }
+  });
+
+  test("every column it does not create is added by the later migration named for it", async () => {
+    for (const entry of ADDED_LATER) {
+      const statements: Array<string> = [];
+
+      await entry.migration.up({
+        query: async (statement: string): Promise<unknown> => {
+          statements.push(statement);
+          return [];
+        },
+      } as unknown as QueryRunner);
+
+      for (const column of entry.columns) {
+        expect({
+          column,
+          added: statements.some((statement: string): boolean => {
+            return statement.startsWith(
+              `ALTER TABLE "${entry.table}" ADD "${column}" `,
+            );
+          }),
+        }).toEqual({ column, added: true });
       }
     }
   });