@oneuptime/common 14.0.13 → 14.0.14

package/Tests/Server/Utils/Greenlock/InMemoryRedis.ts

@@ -0,0 +1,189 @@
+/**
+ * Redis, in memory, for the certificate order suites: the name locks
+ * (Semaphore) and the keys GlobalCache keeps - the on-demand order windows,
+ * the order budgets and the failed-order records.
+ *
+ * It behaves as Redis does for what these suites rely on: a held lock refuses
+ * at once (one acquire attempt), SET NX writes only a missing key, a
+ * conditional delete removes a key only while it holds the given value, and
+ * incrementIfBelow adds nothing once its limit is reached. Keys never expire
+ * on their own; a test moves to a new window by changing the clock, or calls
+ * clearCache. goDown makes every call fail, as a Redis that is down does.
+ */
+
+import Semaphore, {
+  SemaphoreLockTimeoutError,
+  SemaphoreMutex,
+} from "../../../../Server/Infrastructure/Semaphore";
+import GlobalCache from "../../../../Server/Infrastructure/GlobalCache";
+import { jest } from "@jest/globals";
+
+export type LockRequest = {
+  key: string;
+  namespace: string;
+  lockTimeout?: number | undefined;
+  acquireAttemptsLimit?: number | undefined;
+};
+
+export type InMemoryRedis = {
+  // "namespace-key" of every lock held now.
+  heldLocks: Set<string>;
+  // Every lock asked for, in order, granted or not.
+  lockRequests: Array<LockRequest>;
+  // Every cache key, as "namespace-key", with its value.
+  cache: Map<string, string>;
+  // From now on every lock and cache call fails.
+  goDown: () => void;
+  clearCache: () => void;
+};
+
+export function useInMemoryRedis(): InMemoryRedis {
+  let isDown: boolean = false;
+
+  const redis: InMemoryRedis = {
+    heldLocks: new Set<string>(),
+    lockRequests: [],
+    cache: new Map<string, string>(),
+    goDown: (): void => {
+      isDown = true;
+    },
+    clearCache: (): void => {
+      redis.cache.clear();
+    },
+  };
+
+  const failWhenDown: () => void = (): void => {
+    if (isDown) {
+      throw new Error("Cache is not connected");
+    }
+  };
+
+  const fullKey: (namespace: string, key: string) => string = (
+    namespace: string,
+    key: string,
+  ): string => {
+    return `${namespace}-${key}`;
+  };
+
+  jest.spyOn(Semaphore, "lock").mockImplementation((async (
+    data: LockRequest,
+  ) => {
+    redis.lockRequests.push(data);
+    failWhenDown();
+
+    const key: string = fullKey(data.namespace, data.key);
+
+    if (redis.heldLocks.has(key)) {
+      throw new SemaphoreLockTimeoutError(`Acquire mutex ${key} timeout`);
+    }
+
+    redis.heldLocks.add(key);
+
+    return { key: key } as unknown as SemaphoreMutex;
+  }) as never);
+
+  jest.spyOn(Semaphore, "release").mockImplementation((async (
+    mutex: SemaphoreMutex,
+  ) => {
+    redis.heldLocks.delete((mutex as unknown as { key: string }).key);
+  }) as never);
+
+  jest.spyOn(GlobalCache, "getString").mockImplementation((async (
+    namespace: string,
+    key: string,
+  ) => {
+    failWhenDown();
+    return redis.cache.get(fullKey(namespace, key)) ?? null;
+  }) as never);
+
+  jest.spyOn(GlobalCache, "getStrings").mockImplementation((async (
+    namespace: string,
+    keys: Array<string>,
+  ) => {
+    failWhenDown();
+    return keys.map((key: string) => {
+      return redis.cache.get(fullKey(namespace, key)) ?? null;
+    });
+  }) as never);
+
+  jest.spyOn(GlobalCache, "setString").mockImplementation((async (
+    namespace: string,
+    key: string,
+    value: string,
+  ): Promise<void> => {
+    failWhenDown();
+    redis.cache.set(fullKey(namespace, key), value);
+  }) as never);
+
+  jest.spyOn(GlobalCache, "setStringIfNotExists").mockImplementation((async (
+    namespace: string,
+    key: string,
+    value: string,
+  ): Promise<boolean> => {
+    failWhenDown();
+
+    if (redis.cache.has(fullKey(namespace, key))) {
+      return false;
+    }
+
+    redis.cache.set(fullKey(namespace, key), value);
+    return true;
+  }) as never);
+
+  jest.spyOn(GlobalCache, "deleteKey").mockImplementation((async (
+    namespace: string,
+    key: string,
+  ): Promise<void> => {
+    failWhenDown();
+    redis.cache.delete(fullKey(namespace, key));
+  }) as never);
+
+  jest.spyOn(GlobalCache, "deleteKeyIfValue").mockImplementation((async (
+    namespace: string,
+    key: string,
+    value: string,
+  ): Promise<boolean> => {
+    failWhenDown();
+
+    if (redis.cache.get(fullKey(namespace, key)) !== value) {
+      return false;
+    }
+
+    redis.cache.delete(fullKey(namespace, key));
+    return true;
+  }) as never);
+
+  jest.spyOn(GlobalCache, "incrementWithExpiry").mockImplementation((async (
+    namespace: string,
+    key: string,
+  ): Promise<number> => {
+    failWhenDown();
+
+    const count: number =
+      Number(redis.cache.get(fullKey(namespace, key)) || "0") + 1;
+
+    redis.cache.set(fullKey(namespace, key), String(count));
+    return count;
+  }) as never);
+
+  jest.spyOn(GlobalCache, "incrementIfBelow").mockImplementation((async (
+    namespace: string,
+    key: string,
+    options: { limit: number },
+  ): Promise<number | null> => {
+    failWhenDown();
+
+    const current: number = Number(
+      redis.cache.get(fullKey(namespace, key)) || "0",
+    );
+
+    if (current >= options.limit) {
+      return null;
+    }
+
+    redis.cache.set(fullKey(namespace, key), String(current + 1));
+    return current + 1;
+  }) as never);
+
+  return redis;
+}

package/Tests/Server/Utils/Greenlock/NginxAcmeCertificatesToDisk.test.ts

@@ -0,0 +1,242 @@
+/**
+ * nginx's AcmeWriteCertificates job writes every Let's Encrypt certificate
+ * to the directory nginx serves custom domains from, one file per name.
+ *
+ * WriteCustomCertsToDisk writes the certificates customers upload into the
+ * same files. A domain that switched from Let's Encrypt to an uploaded
+ * certificate still has its old Let's Encrypt row, and if both jobs write
+ * that name they overwrite each other every 15 minutes: the domain serves
+ * whichever ran last. These pin that the uploaded certificate wins - the
+ * Let's Encrypt writer leaves those names alone - for status page and
+ * dashboard domains alike.
+ *
+ * The job module from packages/Nginx runs for real; the cron, the file
+ * system and the tables are replaced.
+ */
+
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import AcmeCertificateService from "../../../../Server/Services/AcmeCertificateService";
+import StatusPageDomainService from "../../../../Server/Services/StatusPageDomainService";
+import DashboardDomainService from "../../../../Server/Services/DashboardDomainService";
+import LocalFile from "../../../../Server/Utils/LocalFile";
+import QueryHelper from "../../../../Server/Types/Database/QueryHelper";
+import AcmeWriteCertificatesJob from "../../../../../Nginx/Jobs/AcmeWriteCertificates";
+
+type CronProps = {
+  jobName: string;
+  options: { schedule: string; runOnStartup: boolean };
+  runFunction: () => Promise<void>;
+};
+
+const mockRegisteredCrons: Array<CronProps> = [];
+
+// Hoisted above the imports; the job reads the cron only when init() runs.
+jest.mock("../../../../Server/Utils/BasicCron", () => {
+  return {
+    __esModule: true,
+    default: (props: CronProps): void => {
+      mockRegisteredCrons.push(props);
+    },
+  };
+});
+
+const CERTS_DIRECTORY: string = "/etc/nginx/certs/StatusPageCerts";
+
+const NOT_NULL: { notNull: true } = { notNull: true };
+
+type FindAllByCall = {
+  query: Record<string, unknown>;
+  select: Record<string, unknown>;
+  props: Record<string, unknown>;
+};
+
+type Harness = {
+  files: Map<string, string>;
+  uploadQueries: Array<FindAllByCall>;
+};
+
+function letsEncrypt(domain: string): {
+  domain: string;
+  certificate: string;
+  certificateKey: string;
+} {
+  return {
+    domain: domain,
+    certificate: `lets-encrypt certificate for ${domain}`,
+    certificateKey: `lets-encrypt key for ${domain}`,
+  };
+}
+
+function setUp(data: {
+  acmeDomains: Array<string>;
+  statusPageUploads: Array<string> | Error;
+  dashboardUploads: Array<string> | Error;
+}): Harness {
+  const harness: Harness = {
+    files: new Map<string, string>(),
+    uploadQueries: [],
+  };
+
+  jest.spyOn(QueryHelper, "notNull").mockReturnValue(NOT_NULL as never);
+
+  jest.spyOn(AcmeCertificateService, "findAllBy").mockResolvedValue(
+    data.acmeDomains.map((domain: string) => {
+      return letsEncrypt(domain);
+    }) as never,
+  );
+
+  const answer: (
+    uploads: Array<string> | Error,
+  ) => (call: FindAllByCall) => Promise<Array<{ fullDomain: string }>> = (
+    uploads: Array<string> | Error,
+  ) => {
+    return async (
+      call: FindAllByCall,
+    ): Promise<Array<{ fullDomain: string }>> => {
+      harness.uploadQueries.push(call);
+
+      if (uploads instanceof Error) {
+        throw uploads;
+      }
+
+      return uploads.map((fullDomain: string) => {
+        return { fullDomain: fullDomain };
+      });
+    };
+  };
+
+  jest
+    .spyOn(StatusPageDomainService, "findAllBy")
+    .mockImplementation(answer(data.statusPageUploads) as never);
+
+  jest
+    .spyOn(DashboardDomainService, "findAllBy")
+    .mockImplementation(answer(data.dashboardUploads) as never);
+
+  jest.spyOn(LocalFile, "makeDirectory").mockResolvedValue(undefined as never);
+
+  jest.spyOn(LocalFile, "write").mockImplementation((async (
+    filePath: string,
+    content: string,
+  ): Promise<void> => {
+    harness.files.set(filePath, content);
+  }) as never);
+
+  return harness;
+}
+
+async function runJob(): Promise<void> {
+  mockRegisteredCrons.length = 0;
+  AcmeWriteCertificatesJob.init();
+
+  expect(mockRegisteredCrons).toHaveLength(1);
+  await mockRegisteredCrons[0]!.runFunction();
+}
+
+function writtenDomains(harness: Harness): Array<string> {
+  return [
+    ...new Set(
+      [...harness.files.keys()].map((filePath: string) => {
+        return filePath
+          .slice(CERTS_DIRECTORY.length + 1)
+          .replace(/\.(crt|key)$/, "");
+      }),
+    ),
+  ].sort();
+}
+
+describe("nginx AcmeWriteCertificates", () => {
+  beforeEach(() => {
+    mockRegisteredCrons.length = 0;
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("writes every Let's Encrypt certificate when no domain has uploaded one", async () => {
+    const harness: Harness = setUp({
+      acmeDomains: ["status.acme.com", "dash.acme.com"],
+      statusPageUploads: [],
+      dashboardUploads: [],
+    });
+
+    await runJob();
+
+    expect(writtenDomains(harness)).toEqual([
+      "dash.acme.com",
+      "status.acme.com",
+    ]);
+    expect(harness.files.get(`${CERTS_DIRECTORY}/dash.acme.com.crt`)).toBe(
+      letsEncrypt("dash.acme.com").certificate,
+    );
+  });
+
+  test("leaves alone a name whose status page or dashboard domain serves an uploaded certificate", async () => {
+    const harness: Harness = setUp({
+      acmeDomains: [
+        "status.acme.com",
+        "uploaded-status.acme.com",
+        "dash.acme.com",
+        "uploaded-dash.acme.com",
+      ],
+      statusPageUploads: ["uploaded-status.acme.com"],
+      dashboardUploads: ["Uploaded-Dash.Acme.com "],
+    });
+
+    await runJob();
+
+    expect(writtenDomains(harness)).toEqual([
+      "dash.acme.com",
+      "status.acme.com",
+    ]);
+  });
+
+  test("asks both tables only for domains with an uploaded certificate and key, as root", async () => {
+    const harness: Harness = setUp({
+      acmeDomains: [],
+      statusPageUploads: [],
+      dashboardUploads: [],
+    });
+
+    await runJob();
+
+    expect(harness.uploadQueries).toHaveLength(2);
+
+    for (const query of harness.uploadQueries) {
+      expect(query.query).toEqual({
+        isCustomCertificate: true,
+        customCertificate: NOT_NULL,
+        customCertificateKey: NOT_NULL,
+      });
+      expect(query.select).toEqual({ fullDomain: true });
+      expect(query.props).toEqual({ isRoot: true });
+    }
+  });
+
+  /*
+   * Not knowing which names are uploaded must not leave every custom domain
+   * without a certificate: the job writes everything, as it did before.
+   */
+  test("when the uploaded-certificate domains cannot be read, every Let's Encrypt certificate is still written", async () => {
+    const harness: Harness = setUp({
+      acmeDomains: ["status.acme.com", "dash.acme.com"],
+      statusPageUploads: ["status.acme.com"],
+      dashboardUploads: new Error("dashboard table unavailable"),
+    });
+
+    await expect(runJob()).resolves.toBeUndefined();
+
+    expect(writtenDomains(harness)).toEqual([
+      "dash.acme.com",
+      "status.acme.com",
+    ]);
+  });
+});