@oneuptime/common 14.0.5 → 14.0.6

package/Tests/Server/Services/StatusPageCertificateService.test.ts

@@ -0,0 +1,169 @@
+import StatusPageCertificateService from "../../../Server/Services/StatusPageCertificateService";
+import DatabaseConfig from "../../../Server/DatabaseConfig";
+import { AppApiHostname } from "../../../Server/EnvironmentConfig";
+import API from "../../../Utils/API";
+import Protocol from "../../../Types/API/Protocol";
+import URL from "../../../Types/API/URL";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Custom status page domains get their TLS certificate from the cert worker,
+ * and this service is the only caller. Nothing about it is visible until a
+ * customer's domain fails to serve HTTPS, so what these tests hold is the
+ * request itself: the verb, the worker route, the domain in the body, and the
+ * protocol taken from the instance's own configuration rather than assumed.
+ */
+
+const WORKER_ROUTE: string = "/api/workers/cert";
+const DOMAIN: string = "status.example.com";
+
+type ApiCall = { url: URL; data: Record<string, unknown> };
+
+function lastCall(spy: jest.SpyInstance): ApiCall {
+  return spy.mock.calls[spy.mock.calls.length - 1]?.[0] as ApiCall;
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe.each([
+  { label: "https", protocol: Protocol.HTTPS },
+  { label: "http", protocol: Protocol.HTTP },
+])(
+  "StatusPageCertificateService over $label",
+  ({ protocol }: { protocol: Protocol }) => {
+    function mockProtocol(): jest.SpyInstance {
+      return jest
+        .spyOn(DatabaseConfig, "getHttpProtocol")
+        .mockResolvedValue(protocol as never);
+    }
+
+    test("add posts the domain to the cert worker", async () => {
+      mockProtocol();
+      const postSpy: jest.SpyInstance = jest
+        .spyOn(API, "post")
+        .mockResolvedValue({} as never);
+
+      await StatusPageCertificateService.add(DOMAIN);
+
+      expect(postSpy).toHaveBeenCalledTimes(1);
+      const call: ApiCall = lastCall(postSpy);
+      expect(call.data).toEqual({ domain: DOMAIN });
+      expect(call.url.protocol).toBe(protocol);
+      expect(call.url.hostname.toString()).toBe(AppApiHostname.toString());
+      expect(call.url.route.toString()).toBe(WORKER_ROUTE);
+    });
+
+    test("remove deletes the domain at the same route", async () => {
+      mockProtocol();
+      const deleteSpy: jest.SpyInstance = jest
+        .spyOn(API, "delete")
+        .mockResolvedValue({} as never);
+
+      await StatusPageCertificateService.remove(DOMAIN);
+
+      expect(deleteSpy).toHaveBeenCalledTimes(1);
+      const call: ApiCall = lastCall(deleteSpy);
+      expect(call.data).toEqual({ domain: DOMAIN });
+      expect(call.url.protocol).toBe(protocol);
+      expect(call.url.route.toString()).toBe(WORKER_ROUTE);
+    });
+
+    test("get reads the domain's certificate from the same route", async () => {
+      mockProtocol();
+      const getSpy: jest.SpyInstance = jest
+        .spyOn(API, "get")
+        .mockResolvedValue({} as never);
+
+      await StatusPageCertificateService.get(DOMAIN);
+
+      expect(getSpy).toHaveBeenCalledTimes(1);
+      const call: ApiCall = lastCall(getSpy);
+      expect(call.data).toEqual({ domain: DOMAIN });
+      expect(call.url.protocol).toBe(protocol);
+      expect(call.url.route.toString()).toBe(WORKER_ROUTE);
+    });
+  },
+);
+
+describe("StatusPageCertificateService", () => {
+  test("each verb reads the protocol fresh rather than caching the first answer", async () => {
+    const protocolSpy: jest.SpyInstance = jest
+      .spyOn(DatabaseConfig, "getHttpProtocol")
+      .mockResolvedValueOnce(Protocol.HTTP as never)
+      .mockResolvedValueOnce(Protocol.HTTPS as never);
+    const postSpy: jest.SpyInstance = jest
+      .spyOn(API, "post")
+      .mockResolvedValue({} as never);
+
+    await StatusPageCertificateService.add(DOMAIN);
+    await StatusPageCertificateService.add(DOMAIN);
+
+    expect(protocolSpy).toHaveBeenCalledTimes(2);
+    expect((postSpy.mock.calls[0]?.[0] as ApiCall).url.protocol).toBe(
+      Protocol.HTTP,
+    );
+    expect((postSpy.mock.calls[1]?.[0] as ApiCall).url.protocol).toBe(
+      Protocol.HTTPS,
+    );
+  });
+
+  test("the three verbs do not call one another", async () => {
+    jest
+      .spyOn(DatabaseConfig, "getHttpProtocol")
+      .mockResolvedValue(Protocol.HTTPS as never);
+    const postSpy: jest.SpyInstance = jest
+      .spyOn(API, "post")
+      .mockResolvedValue({} as never);
+    const deleteSpy: jest.SpyInstance = jest
+      .spyOn(API, "delete")
+      .mockResolvedValue({} as never);
+    const getSpy: jest.SpyInstance = jest
+      .spyOn(API, "get")
+      .mockResolvedValue({} as never);
+
+    await StatusPageCertificateService.get(DOMAIN);
+
+    expect(getSpy).toHaveBeenCalledTimes(1);
+    expect(postSpy).not.toHaveBeenCalled();
+    expect(deleteSpy).not.toHaveBeenCalled();
+
+    await StatusPageCertificateService.remove(DOMAIN);
+
+    expect(deleteSpy).toHaveBeenCalledTimes(1);
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test("the domain is passed through untouched, punycode and all", async () => {
+    jest
+      .spyOn(DatabaseConfig, "getHttpProtocol")
+      .mockResolvedValue(Protocol.HTTPS as never);
+    const postSpy: jest.SpyInstance = jest
+      .spyOn(API, "post")
+      .mockResolvedValue({} as never);
+
+    for (const domain of [
+      "status.example.com",
+      "xn--80ak6aa92e.example.com",
+      "STATUS.EXAMPLE.COM",
+      "status.example.co.uk",
+    ]) {
+      await StatusPageCertificateService.add(domain);
+      expect(lastCall(postSpy).data).toEqual({ domain: domain });
+    }
+  });
+
+  test("a failing worker call is surfaced, not swallowed", async () => {
+    jest
+      .spyOn(DatabaseConfig, "getHttpProtocol")
+      .mockResolvedValue(Protocol.HTTPS as never);
+    jest
+      .spyOn(API, "post")
+      .mockRejectedValue(new Error("cert worker unreachable") as never);
+
+    await expect(StatusPageCertificateService.add(DOMAIN)).rejects.toThrow(
+      "cert worker unreachable",
+    );
+  });
+});

package/Tests/Server/Services/TeamComplianceSettingService.test.ts

@@ -0,0 +1,191 @@
+import TeamComplianceSettingService from "../../../Server/Services/TeamComplianceSettingService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import { OnCreate } from "../../../Server/Types/Database/Hooks";
+import TeamComplianceSetting from "../../../Models/DatabaseModels/TeamComplianceSetting";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * A team may hold at most one compliance setting per rule type: two rows for
+ * the same rule would leave the compliance check with no defined answer. The
+ * guard lives in onBeforeCreate, and these tests hold it to refusing loudly
+ * (BadDataException naming the rule type), to scoping the duplicate lookup by
+ * team *and* rule type -- so the same rule on another team is still allowed --
+ * and to running that lookup as root, since the row that already exists may be
+ * one the caller cannot see.
+ */
+
+type OnBeforeCreateFunction = (
+  createBy: CreateBy<TeamComplianceSetting>,
+) => Promise<OnCreate<TeamComplianceSetting>>;
+
+const TEAM_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const OTHER_TEAM_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const RULE_TYPE: string = "RequireTwoFactorAuth";
+
+function onBeforeCreate(
+  createBy: CreateBy<TeamComplianceSetting>,
+): Promise<OnCreate<TeamComplianceSetting>> {
+  return (
+    TeamComplianceSettingService as unknown as {
+      onBeforeCreate: OnBeforeCreateFunction;
+    }
+  ).onBeforeCreate(createBy);
+}
+
+function buildCreateBy(data: {
+  teamId?: ObjectID;
+  ruleType?: string;
+}): CreateBy<TeamComplianceSetting> {
+  const setting: TeamComplianceSetting = new TeamComplianceSetting();
+  if (data.teamId) {
+    setting.teamId = data.teamId;
+  }
+  if (data.ruleType) {
+    (setting as unknown as Record<string, unknown>)["ruleType"] = data.ruleType;
+  }
+  return {
+    data: setting,
+    props: { isRoot: true },
+  } as CreateBy<TeamComplianceSetting>;
+}
+
+function mockExisting(
+  existing: TeamComplianceSetting | null,
+): jest.SpyInstance {
+  return jest
+    .spyOn(TeamComplianceSettingService, "findOneBy")
+    .mockResolvedValue(existing as never);
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("TeamComplianceSettingService onBeforeCreate", () => {
+  test("allows the first setting for a team and rule type", async () => {
+    mockExisting(null);
+
+    const createBy: CreateBy<TeamComplianceSetting> = buildCreateBy({
+      teamId: TEAM_ID,
+      ruleType: RULE_TYPE,
+    });
+    const result: OnCreate<TeamComplianceSetting> =
+      await onBeforeCreate(createBy);
+
+    expect(result.createBy).toBe(createBy);
+    expect(result.carryForward).toBeNull();
+  });
+
+  test("refuses a second setting for the same team and rule type", async () => {
+    const existing: TeamComplianceSetting = new TeamComplianceSetting();
+    existing._id = "33333333-3333-4333-8333-333333333333";
+    mockExisting(existing);
+
+    await expect(
+      onBeforeCreate(buildCreateBy({ teamId: TEAM_ID, ruleType: RULE_TYPE })),
+    ).rejects.toThrow(BadDataException);
+  });
+
+  test("the refusal names the rule type, so the form can point at it", async () => {
+    const existing: TeamComplianceSetting = new TeamComplianceSetting();
+    existing._id = "33333333-3333-4333-8333-333333333333";
+    mockExisting(existing);
+
+    await expect(
+      onBeforeCreate(buildCreateBy({ teamId: TEAM_ID, ruleType: RULE_TYPE })),
+    ).rejects.toThrow(
+      `A compliance setting for rule type "${RULE_TYPE}" already exists for this team.`,
+    );
+  });
+
+  test("the duplicate lookup is keyed on both the team and the rule type", async () => {
+    const findSpy: jest.SpyInstance = mockExisting(null);
+
+    await onBeforeCreate(
+      buildCreateBy({ teamId: TEAM_ID, ruleType: RULE_TYPE }),
+    );
+
+    const findArgs: Record<string, unknown> = findSpy.mock
+      .calls[0]?.[0] as Record<string, unknown>;
+    expect(findArgs["query"]).toEqual({
+      teamId: TEAM_ID,
+      ruleType: RULE_TYPE,
+    });
+    // Only the id is needed to know whether one exists.
+    expect(findArgs["select"]).toEqual({ _id: true });
+  });
+
+  test("the lookup runs as root: the existing row may be invisible to the caller", async () => {
+    const findSpy: jest.SpyInstance = mockExisting(null);
+
+    await onBeforeCreate(
+      buildCreateBy({ teamId: TEAM_ID, ruleType: RULE_TYPE }),
+    );
+
+    const findArgs: Record<string, unknown> = findSpy.mock
+      .calls[0]?.[0] as Record<string, unknown>;
+    expect(findArgs["props"]).toEqual({ isRoot: true });
+  });
+
+  test("the same rule type on a different team is a different row", async () => {
+    const findSpy: jest.SpyInstance = jest
+      .spyOn(TeamComplianceSettingService, "findOneBy")
+      .mockImplementation(((
+        args: Record<string, unknown>,
+      ): Promise<unknown> => {
+        const query: Record<string, unknown> = args["query"] as Record<
+          string,
+          unknown
+        >;
+        // Only the first team already holds this rule.
+        if (query["teamId"] === TEAM_ID) {
+          const existing: TeamComplianceSetting = new TeamComplianceSetting();
+          existing._id = "33333333-3333-4333-8333-333333333333";
+          return Promise.resolve(existing);
+        }
+        return Promise.resolve(null);
+      }) as never);
+
+    await expect(
+      onBeforeCreate(buildCreateBy({ teamId: TEAM_ID, ruleType: RULE_TYPE })),
+    ).rejects.toThrow(BadDataException);
+
+    await expect(
+      onBeforeCreate(
+        buildCreateBy({ teamId: OTHER_TEAM_ID, ruleType: RULE_TYPE }),
+      ),
+    ).resolves.toBeDefined();
+
+    expect(findSpy).toHaveBeenCalledTimes(2);
+  });
+
+  test("a different rule type on the same team is allowed", async () => {
+    const findSpy: jest.SpyInstance = jest
+      .spyOn(TeamComplianceSettingService, "findOneBy")
+      .mockImplementation(((
+        args: Record<string, unknown>,
+      ): Promise<unknown> => {
+        const query: Record<string, unknown> = args["query"] as Record<
+          string,
+          unknown
+        >;
+        if (query["ruleType"] === RULE_TYPE) {
+          const existing: TeamComplianceSetting = new TeamComplianceSetting();
+          existing._id = "33333333-3333-4333-8333-333333333333";
+          return Promise.resolve(existing);
+        }
+        return Promise.resolve(null);
+      }) as never);
+
+    await expect(
+      onBeforeCreate(
+        buildCreateBy({ teamId: TEAM_ID, ruleType: "RequirePhoneNumber" }),
+      ),
+    ).resolves.toBeDefined();
+    expect(findSpy).toHaveBeenCalledTimes(1);
+  });
+});