@oneuptime/common 14.0.7 → 14.0.8

package/Tests/Server/API/StatusPageManageSubscriptionRecipient.test.ts

@@ -362,6 +362,11 @@ describe("StatusPageAPI manage-subscription link recipient", () => {
       .spyOn(StatusPageSubscriberService, "findBy")
       .mockImplementation(findByFake as never);
 
+    // Their unsubscribe tokens are topped up in the database; nothing to top up here.
+    jest
+      .spyOn(StatusPageSubscriberService, "ensureUnsubscribeTokens")
+      .mockResolvedValue(undefined as never);
+
     jest
       .spyOn(StatusPageSubscriberService, "getStatusPagesToSendNotification")
       .mockImplementation((): Promise<Array<StatusPage>> => {
@@ -610,8 +615,12 @@ describe("StatusPageAPI manage-subscription link recipient", () => {
       expect(lookup.query["statusPageId"]?.toString()).toBe(
         statusPageId.toString(),
       );
+      /*
+       * The contact for this channel only, and the unsubscribe token for the
+       * link that works without signing in.
+       */
       expect(Object.keys(lookup.select).sort()).toEqual(
-        ["_id", "subscriberPhone"].sort(),
+        ["_id", "subscriberPhone", "unsubscribeToken"].sort(),
       );
       expect(lookup.sort).toEqual({ createdAt: SortOrder.Ascending });
       expect(lookup.skip).toBe(0);

package/Tests/Server/API/StatusPageManageSubscriptionTemplateVariables.test.ts

@@ -99,6 +99,27 @@ const STATUS_PAGE_URL: string = "https://status.acme-example.com";
 const MANAGE_URL: string =
   "https://status.acme-example.com/update-subscription/c47d2e19-5b8a-4e36-a0f2-7d91b3c56e28";
 
+/*
+ * The subscription's unsubscribe token, and the link that works without
+ * signing in - which the manage page on a private status page does not.
+ */
+const UNSUBSCRIBE_TOKEN: string = "5d".repeat(32);
+const UNSUBSCRIBE_URL: string = `https://status.acme-example.com/unsubscribe/c47d2e19-5b8a-4e36-a0f2-7d91b3c56e28-${UNSUBSCRIBE_TOKEN}`;
+
+/*
+ * The unsubscribeUrl a channel's template is given. An SMS from a public
+ * status page gets the (shorter) manage link, as every other SMS from one
+ * does - an SMS is billed by the segment (see
+ * StatusPageSubscriberUnsubscribe.buildSmsLink); the fixture page is public.
+ */
+function unsubscribeUrlOnPublicPage(
+  method: StatusPageSubscriberNotificationMethod,
+): string {
+  return method === StatusPageSubscriberNotificationMethod.SMS
+    ? MANAGE_URL
+    : UNSUBSCRIBE_URL;
+}
+
 const SUBSCRIBER_EMAIL: string = "manage.subscriber@acme-example.com";
 const SUBSCRIBER_PHONE: string = "+15550100123";
 const SLACK_WORKSPACE_NAME: string = "acme-ops-workspace";
@@ -398,15 +419,45 @@ describe("StatusPageAPI manage-subscription templates", () => {
 
   type CompileCallsFunction = () => Array<CompileCall>;
 
+  /*
+   * Every compile, in the order it was made: the email body through
+   * compileEmailBodyTemplate (it is HTML, so its values are escaped), and
+   * the subject, SMS, Slack and Teams through compileTemplate.
+   */
   const compileCalls: CompileCallsFunction = (): Array<CompileCall> => {
-    return mockOf(
+    const recorded: Array<{ order: number; call: CompileCall }> = [];
+
+    for (const compile of [
       StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate,
-    ).mock.calls.map((call: Array<unknown>): CompileCall => {
-      return {
-        template: call[0] as string,
-        variables: call[1] as Record<string, string>,
-      };
-    });
+      StatusPageSubscriberNotificationTemplateServiceClass.compileEmailBodyTemplate,
+    ]) {
+      const calls: jest.MockContext<unknown, Array<unknown>> = mockOf(
+        compile,
+      ).mock;
+
+      calls.calls.forEach((call: Array<unknown>, index: number): void => {
+        recorded.push({
+          order: calls.invocationCallOrder[index]!,
+          call: {
+            template: call[0] as string,
+            variables: call[1] as Record<string, string>,
+          },
+        });
+      });
+    }
+
+    return recorded
+      .sort(
+        (
+          a: { order: number; call: CompileCall },
+          b: { order: number; call: CompileCall },
+        ): number => {
+          return a.order - b.order;
+        },
+      )
+      .map((entry: { order: number; call: CompileCall }): CompileCall => {
+        return entry.call;
+      });
   };
 
   type SentMailFunction = () => Array<JSONObject>;
@@ -486,6 +537,7 @@ describe("StatusPageAPI manage-subscription templates", () => {
 
     const subscriber: StatusPageSubscriber = new StatusPageSubscriber();
     subscriber.id = new ObjectID(SUBSCRIBER_ID);
+    subscriber.unsubscribeToken = UNSUBSCRIBE_TOKEN;
 
     if (query["subscriberEmail"]?.toString() === SUBSCRIBER_EMAIL) {
       subscriber.subscriberEmail = new Email(SUBSCRIBER_EMAIL);
@@ -569,8 +621,9 @@ describe("StatusPageAPI manage-subscription templates", () => {
         return Promise.resolve([pageToSend]);
       });
 
-    // The real link builder, watched.
+    // The real link builders, watched.
     jest.spyOn(StatusPageSubscriberService, "getUnsubscribeLink");
+    jest.spyOn(StatusPageSubscriberService, "getManageSubscriptionLink");
 
     jest
       .spyOn(
@@ -584,6 +637,10 @@ describe("StatusPageAPI manage-subscription templates", () => {
       StatusPageSubscriberNotificationTemplateServiceClass,
       "compileTemplate",
     );
+    jest.spyOn(
+      StatusPageSubscriberNotificationTemplateServiceClass,
+      "compileEmailBodyTemplate",
+    );
 
     jest.spyOn(MailService, "sendMail").mockResolvedValue(undefined as never);
     jest.spyOn(SmsService, "sendSms").mockResolvedValue(undefined as never);
@@ -776,39 +833,134 @@ describe("StatusPageAPI manage-subscription templates", () => {
 
   describe("variable values", () => {
     it.each(CHANNELS)(
-      "$name: unsubscribeUrl is the subscriber's manage link",
+      "$name: manageSubscriptionUrl is the manage page and unsubscribeUrl the token link",
       async (channel: ChannelCase) => {
         useCustomTemplatesOnEveryChannel();
 
         await callManageSubscription(channel.requestData);
 
-        // Built by the real helper from the page URL and this subscriber.
+        // Built by the real helpers from the page URL and this subscriber.
+        const manageCalls: Array<Array<unknown>> = mockOf(
+          StatusPageSubscriberService.getManageSubscriptionLink,
+        ).mock.calls as Array<Array<unknown>>;
+        expect(manageCalls).toHaveLength(1);
+        expect((manageCalls[0]![0] as URL).toString()).toBe(
+          URL.fromString(STATUS_PAGE_URL).toString(),
+        );
+        expect((manageCalls[0]![1] as ObjectID).toString()).toBe(SUBSCRIBER_ID);
+
+        /*
+         * The unsubscribe link is built from the subscriber row the lookup
+         * read - token included - so it works without signing in.
+         */
         const linkCalls: Array<Array<unknown>> = mockOf(
           StatusPageSubscriberService.getUnsubscribeLink,
         ).mock.calls as Array<Array<unknown>>;
         expect(linkCalls).toHaveLength(1);
-        expect((linkCalls[0]![0] as URL).toString()).toBe(
-          URL.fromString(STATUS_PAGE_URL).toString(),
-        );
-        expect((linkCalls[0]![1] as ObjectID).toString()).toBe(SUBSCRIBER_ID);
+        expect(
+          (linkCalls[0]![1] as StatusPageSubscriber).unsubscribeToken,
+        ).toBe(UNSUBSCRIBE_TOKEN);
 
-        expect(MANAGE_URL).not.toBe(STATUS_PAGE_URL);
         expect(MANAGE_URL).toContain(SUBSCRIBER_ID);
+        expect(UNSUBSCRIBE_URL).toContain(UNSUBSCRIBE_TOKEN);
 
         const calls: Array<CompileCall> = compileCalls();
         expect(calls).toHaveLength(channel.compileCallsPerRequest);
         for (const call of calls) {
-          expect(call.variables["unsubscribeUrl"]).toBe(MANAGE_URL);
+          expect(call.variables["unsubscribeUrl"]).toBe(
+            unsubscribeUrlOnPublicPage(channel.method),
+          );
           expect(call.variables["manageSubscriptionUrl"]).toBe(MANAGE_URL);
           expect(call.variables["statusPageUrl"]).toBe(STATUS_PAGE_URL);
         }
 
         expect(renderedMessage(channel)).toContain(
-          `unsubscribeUrl=[${MANAGE_URL}]`,
+          `unsubscribeUrl=[${unsubscribeUrlOnPublicPage(channel.method)}]`,
         );
       },
     );
 
+    it("sms from a private status page: unsubscribeUrl is the token link, since its manage page needs a signed-in visitor", async () => {
+      const smsChannel: ChannelCase = CHANNELS.find(
+        (channel: ChannelCase): boolean => {
+          return channel.method === StatusPageSubscriberNotificationMethod.SMS;
+        },
+      )!;
+
+      useCustomTemplatesOnEveryChannel();
+      pageToSend.isPublicStatusPage = false;
+
+      await callManageSubscription(smsChannel.requestData);
+
+      const calls: Array<CompileCall> = compileCalls();
+      expect(calls).toHaveLength(smsChannel.compileCallsPerRequest);
+      for (const call of calls) {
+        expect(call.variables["unsubscribeUrl"]).toBe(UNSUBSCRIBE_URL);
+        expect(call.variables["manageSubscriptionUrl"]).toBe(MANAGE_URL);
+      }
+      expect(renderedMessage(smsChannel)).toContain(
+        `unsubscribeUrl=[${UNSUBSCRIBE_URL}]`,
+      );
+    });
+
+    it("reads each subscriber's unsubscribe token with the lookup", async () => {
+      await callManageSubscription(CHANNELS[0]!.requestData);
+
+      const select: JSONObject = (
+        mockOf(StatusPageSubscriberService.findBy).mock.calls[0]![0] as {
+          select: JSONObject;
+        }
+      ).select;
+
+      expect(select["unsubscribeToken"]).toBe(true);
+    });
+
+    /*
+     * Every other sender tops up a missing token before building the link
+     * (ensureUnsubscribeTokens); a subscriber the backfill has not reached
+     * yet would otherwise be sent a link to the "out of date" page.
+     */
+    it("a subscriber read without its token is given one before the link is built", async () => {
+      const toppedUpToken: string = "9c".repeat(32);
+
+      jest
+        .spyOn(StatusPageSubscriberService, "findBy")
+        .mockImplementation((async (findBy: { query: JSONObject }) => {
+          const found: Array<StatusPageSubscriber> =
+            await findSubscribersFake(findBy);
+
+          for (const subscriber of found) {
+            subscriber.unsubscribeToken = undefined as unknown as string;
+          }
+
+          return found;
+        }) as never);
+
+      const ensure: jest.SpyInstance = jest
+        .spyOn(StatusPageSubscriberService, "ensureUnsubscribeTokens")
+        .mockImplementation((async (
+          subscribers: Array<StatusPageSubscriber>,
+        ): Promise<void> => {
+          for (const subscriber of subscribers) {
+            subscriber.unsubscribeToken = toppedUpToken;
+          }
+        }) as never);
+
+      useCustomTemplatesOnEveryChannel();
+
+      await callManageSubscription(CHANNELS[0]!.requestData);
+
+      expect(ensure).toHaveBeenCalledTimes(1);
+
+      const calls: Array<CompileCall> = compileCalls();
+      expect(calls.length).toBeGreaterThan(0);
+      for (const call of calls) {
+        expect(call.variables["unsubscribeUrl"]).toBe(
+          `${STATUS_PAGE_URL}/unsubscribe/${SUBSCRIBER_ID}-${toppedUpToken}`,
+        );
+      }
+    });
+
     it.each(CHANNELS)(
       "$name: statusPageName is the page's public title, not its internal name",
       async (channel: ChannelCase) => {
@@ -834,6 +986,42 @@ describe("StatusPageAPI manage-subscription templates", () => {
       },
     );
 
+    /*
+     * The email body is HTML, so the page's title - which a project member
+     * typed - is escaped into it and cannot add markup. SMS, Slack and Teams
+     * show text as written, and the subject is plain text, so they get it
+     * unchanged.
+     */
+    it.each(CHANNELS)(
+      "$name: a page title holding markup is escaped only in the email body",
+      async (channel: ChannelCase) => {
+        const hostileTitle: string =
+          '<a href="https://evil.example/login">Acme</a> & "Co"';
+        useCustomTemplatesOnEveryChannel();
+        pageToSend = statusPageFixture({
+          withCustomSmtpAndSms: true,
+          pageTitle: hostileTitle,
+        });
+
+        await callManageSubscription(channel.requestData);
+
+        const message: string = renderedMessage(channel);
+
+        if (channel.method === StatusPageSubscriberNotificationMethod.Email) {
+          expect(message).toContain(
+            "statusPageName=[&lt;a href=&quot;https://evil.example/login&quot;&gt;Acme&lt;/a&gt; &amp; &quot;Co&quot;]",
+          );
+          expect(message).not.toContain("<a href");
+          expect(sentMail()[0]!["subject"]).toBe(
+            `Manage ${hostileTitle} at ${MANAGE_URL}`,
+          );
+        } else {
+          expect(message).toContain(`statusPageName=[${hostileTitle}]`);
+          expect(message).not.toMatch(/&(?:amp|lt|gt|quot|#39);/);
+        }
+      },
+    );
+
     interface NameFallbackCase {
       channel: ChannelCase;
       label: string;
@@ -901,7 +1089,7 @@ describe("StatusPageAPI manage-subscription templates", () => {
         const expectedValues: Record<string, string> = {
           statusPageName: PAGE_TITLE,
           statusPageUrl: STATUS_PAGE_URL,
-          unsubscribeUrl: MANAGE_URL,
+          unsubscribeUrl: unsubscribeUrlOnPublicPage(channel.method),
           manageSubscriptionUrl: MANAGE_URL,
         };
 

package/Tests/Server/API/StatusPagePostmortemVisibility.test.ts

@@ -86,6 +86,7 @@ function mockServices(data: { overview: boolean }): Fixtures {
   page.projectId = ObjectID.generate();
   page.isPublicStatusPage = true;
   page.showIncidentsOnStatusPage = true;
+  page.onlyShowScopedIncidents = false;
 
   const resource: StatusPageResource = new StatusPageResource();
   resource._id = ObjectID.generate().toString();
@@ -223,6 +224,15 @@ function mockServices(data: { overview: boolean }): Fixtures {
       return Promise.resolve([]);
     }
 
+    /*
+     * Each read is asked in two halves (IncidentStatusPageScope): incidents
+     * limited to no status page, which these all are, and incidents limited
+     * to this page, of which there are none.
+     */
+    if (query["isScopedToStatusPages"] !== false) {
+      return Promise.resolve([]);
+    }
+
     if (query["_id"]) {
       return Promise.resolve(
         incidents.filter((incident: Incident) => {
@@ -406,7 +416,8 @@ describe("StatusPageAPI postmortem visibility", () => {
         statusPageId: fixtures.statusPageId,
       });
 
-      expect(fixtures.incidentReadSpy).toHaveBeenCalledTimes(2);
+      // Recent and active incidents, each read in two halves.
+      expect(fixtures.incidentReadSpy).toHaveBeenCalledTimes(2 * 2);
       expectVisibility({
         payload,
         key: "incidents",
@@ -433,7 +444,8 @@ describe("StatusPageAPI postmortem visibility", () => {
         incidentId: incident._id!,
       });
 
-      expect(fixtures.incidentReadSpy).toHaveBeenCalledTimes(1);
+      // The one incident, read in two halves.
+      expect(fixtures.incidentReadSpy).toHaveBeenCalledTimes(2);
       expectVisibility({ payload, key: "incidents", incidents: [incident] });
       expectSourcesUnchanged(fixtures);
     },

package/Tests/Server/API/StatusPageSubscriberCreateResponse.test.ts

@@ -0,0 +1,217 @@
+import StatusPageSubscriber from "../../../Models/DatabaseModels/StatusPageSubscriber";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import BaseAPI from "../../../Server/API/BaseAPI";
+import DatabaseService from "../../../Server/Services/DatabaseService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import StatusPageSubscriberService, {
+  Service as StatusPageSubscriberServiceClass,
+} from "../../../Server/Services/StatusPageSubscriberService";
+import {
+  RunOptions,
+  RunReturnType,
+} from "../../../Server/Types/Workflow/ComponentCode";
+import CreateManyBaseModel from "../../../Server/Types/Workflow/Components/BaseModel/CreateManyBaseModel";
+import CreateOneBaseModel from "../../../Server/Types/Workflow/Components/BaseModel/CreateOneBaseModel";
+import {
+  ExpressResponse,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import Email from "../../../Types/Email";
+import Exception from "../../../Types/Exception/Exception";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import UserType from "../../../Types/UserType";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+  };
+});
+
+/*
+ * A subscriber's create hands back the row it saved, and the unsubscribe
+ * token and the confirmation code are on that row: StatusPageSubscriberService
+ * minted them in onBeforeCreate. Nobody may read either column (read: []), but
+ * the create response of POST /status-page-subscriber is serialized whole,
+ * without a column read check - so a teammate's Add Subscriber or Add in Bulk,
+ * or any API key, got the token back, and could cancel the subscription
+ * "through the link", which the team's notice then blamed on the subscriber.
+ * A workflow's Create Status Page Subscriber step returned it too, and step
+ * return values are kept in the workflow's logs.
+ *
+ * DatabaseService.create is replaced with one that returns the saved row as
+ * the real one does, secrets and all; the service's own create is real.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "10000000-0000-4000-8000-000000000001",
+);
+const STATUS_PAGE_ID: ObjectID = new ObjectID(
+  "20000000-0000-4000-8000-000000000002",
+);
+const SUBSCRIBER_ID: string = "30000000-0000-4000-8000-000000000003";
+const TOKEN: string = "4d".repeat(32);
+const CONFIRMATION_CODE: string = "654321";
+
+function savedRow(): StatusPageSubscriber {
+  const row: StatusPageSubscriber = new StatusPageSubscriber();
+  row._id = SUBSCRIBER_ID;
+  row.projectId = PROJECT_ID;
+  row.statusPageId = STATUS_PAGE_ID;
+  row.subscriberEmail = new Email("site03-all@acme.com");
+  row.isSubscriptionConfirmed = true;
+  row.isAddedByTeam = true;
+  row.unsubscribeToken = TOKEN;
+  row.subscriptionConfirmationToken = CONFIRMATION_CODE;
+  return row;
+}
+
+function expectNoSecrets(json: JSONObject): void {
+  const text: string = JSON.stringify(json);
+
+  expect(json["unsubscribeToken"]).toBeUndefined();
+  expect(json["subscriptionConfirmationToken"]).toBeUndefined();
+  expect(text).not.toContain(TOKEN);
+  expect(text).not.toContain(CONFIRMATION_CODE);
+
+  // The rest of the row is still there.
+  expect(json["_id"]).toBe(SUBSCRIBER_ID);
+  expect(JSON.stringify(json["subscriberEmail"])).toContain(
+    "site03-all@acme.com",
+  );
+}
+
+beforeEach(() => {
+  // With billing on, the request's props carry the project's plan.
+  jest
+    .spyOn(ProjectService, "getCurrentPlan")
+    .mockResolvedValue({ plan: null, isSubscriptionUnpaid: false } as never);
+
+  jest.spyOn(DatabaseService.prototype, "create").mockImplementation((() => {
+    return Promise.resolve(savedRow());
+  }) as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  jest.clearAllMocks();
+});
+
+describe("POST /status-page-subscriber answers without the subscriber's secrets", () => {
+  function request(userType: UserType): OneUptimeRequest {
+    return {
+      params: {},
+      headers: {},
+      userType: userType,
+      tenantId: PROJECT_ID,
+      body: {
+        data: {
+          statusPageId: STATUS_PAGE_ID.toString(),
+          subscriberEmail: "site03-all@acme.com",
+        },
+      },
+    } as unknown as OneUptimeRequest;
+  }
+
+  test.each([
+    ["a teammate's Add Subscriber or Add in Bulk", UserType.User],
+    ["an API key", UserType.API],
+  ])("%s", async (_label: string, userType: UserType) => {
+    const api: BaseAPI<StatusPageSubscriber, StatusPageSubscriberServiceClass> =
+      new BaseAPI<StatusPageSubscriber, StatusPageSubscriberServiceClass>(
+        StatusPageSubscriber,
+        StatusPageSubscriberService,
+      );
+
+    await api.createItem(request(userType), {} as ExpressResponse);
+
+    const sendEntityResponse: jest.Mock =
+      Response.sendEntityResponse as unknown as jest.Mock;
+    expect(sendEntityResponse).toHaveBeenCalledTimes(1);
+
+    const item: StatusPageSubscriber = sendEntityResponse.mock
+      .calls[0]![2] as StatusPageSubscriber;
+
+    // What Response.sendEntityResponse serializes: every column that is set.
+    expectNoSecrets(BaseModel.toJSON(item, StatusPageSubscriber));
+  });
+});
+
+describe("a workflow's create steps return the subscriber without its secrets", () => {
+  function options(): RunOptions {
+    return {
+      log: jest.fn() as unknown as RunOptions["log"],
+      workflowLogId: ObjectID.generate(),
+      workflowId: ObjectID.generate(),
+      projectId: PROJECT_ID,
+      onError: ((exception: Exception): Exception => {
+        return exception;
+      }) as RunOptions["onError"],
+      executeWorkflow: async (): Promise<void> => {},
+    };
+  }
+
+  test("Create Status Page Subscriber", async () => {
+    const component: CreateOneBaseModel<StatusPageSubscriber> =
+      new CreateOneBaseModel<StatusPageSubscriber>(StatusPageSubscriberService);
+
+    const result: RunReturnType = await component.run(
+      {
+        json: {
+          statusPageId: STATUS_PAGE_ID.toString(),
+          subscriberEmail: "site03-all@acme.com",
+        },
+      },
+      options(),
+    );
+
+    expect(result.executePort?.id).toBe("success");
+    expectNoSecrets(result.returnValues["model"] as JSONObject);
+  });
+
+  test("Create Many Status Page Subscribers", async () => {
+    const component: CreateManyBaseModel<StatusPageSubscriber> =
+      new CreateManyBaseModel<StatusPageSubscriber>(
+        StatusPageSubscriberService,
+      );
+
+    const result: RunReturnType = await component.run(
+      {
+        "json-array": [
+          {
+            statusPageId: STATUS_PAGE_ID.toString(),
+            subscriberEmail: "site03-all@acme.com",
+          },
+        ],
+      },
+      options(),
+    );
+
+    expect(result.executePort?.id).toBe("success");
+
+    const models: JSONArray = result.returnValues["models"] as JSONArray;
+    expect(models).toHaveLength(1);
+    expectNoSecrets(models[0] as JSONObject);
+  });
+});