@oneuptime/common 14.0.7 → 14.0.9

package/Tests/Server/Utils/StatusPage/StatusPageReadAccess.test.ts

@@ -0,0 +1,221 @@
+import StatusPage from "../../../../Models/DatabaseModels/StatusPage";
+import StatusPageService from "../../../../Server/Services/StatusPageService";
+import StatusPageReadAccess from "../../../../Server/Utils/StatusPage/StatusPageReadAccess";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Dictionary from "../../../../Types/Dictionary";
+import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../Types/ObjectID";
+import getJestMockFunction, { MockFunction } from "../../../MockType";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * Limiting an incident (or an incident template) to a status page decides
+ * who is told about it, so picking a page needs read access to it - through
+ * the API as well as the dashboard picker, which only lists readable pages.
+ * The status page service answers with the caller's own permissions and
+ * labels; it is stubbed here, as is which pages the caller may read.
+ */
+
+const PAGE_A: string = "b0000000-0000-4000-8000-00000000000a";
+const PAGE_B: string = "b0000000-0000-4000-8000-00000000000b";
+const PAGE_C: string = "b0000000-0000-4000-8000-00000000000c";
+
+const CALLER: DatabaseCommonInteractionProps = {
+  userId: new ObjectID("5d7f3c0a-4c55-4d3e-9a3e-2d4a7d1c9e02"),
+  tenantId: new ObjectID("5d7f3c0a-4c55-4d3e-9a3e-2d4a7d1c9e01"),
+};
+
+// The pages the caller may read; null means no status page access at all.
+let readable: Array<string> | null = [];
+let findBy: MockFunction;
+
+function requestedIds(query: { _id: unknown }): Array<string> {
+  const operator: { objectLiteralParameters?: Dictionary<unknown> } =
+    query._id as { objectLiteralParameters?: Dictionary<unknown> };
+
+  return (
+    Object.values(operator.objectLiteralParameters || {}) as Array<
+      Array<string>
+    >
+  )
+    .flat()
+    .map((id: string): string => {
+      return id.toLowerCase();
+    });
+}
+
+beforeEach(() => {
+  readable = [PAGE_A];
+
+  findBy = getJestMockFunction();
+  findBy.mockImplementation(
+    (data: { query: { _id: unknown } }): Promise<Array<StatusPage>> => {
+      if (readable === null) {
+        return Promise.reject(
+          new NotAuthorizedException(
+            "You do not have permissions to read Status Page.",
+          ),
+        );
+      }
+
+      return Promise.resolve(
+        requestedIds(data.query)
+          .filter((id: string): boolean => {
+            return readable!.includes(id);
+          })
+          .map((id: string): StatusPage => {
+            const page: StatusPage = new StatusPage();
+            page._id = id;
+            return page;
+          }),
+      );
+    },
+  );
+
+  jest.spyOn(StatusPageService, "findBy").mockImplementation(findBy as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("StatusPageReadAccess.getReadableStatusPageIds", () => {
+  test("asks the status page service with the caller's own props", async () => {
+    expect(
+      await StatusPageReadAccess.getReadableStatusPageIds({
+        statusPageIds: [PAGE_A, PAGE_B.toUpperCase()],
+        props: CALLER,
+      }),
+    ).toEqual([PAGE_A]);
+
+    expect(findBy).toHaveBeenCalledTimes(1);
+    expect(findBy.mock.calls[0]![0].props).toBe(CALLER);
+    expect(requestedIds(findBy.mock.calls[0]![0].query)).toEqual([
+      PAGE_A,
+      PAGE_B,
+    ]);
+  });
+
+  test("a caller with no status page access reads none of them", async () => {
+    readable = null;
+
+    expect(
+      await StatusPageReadAccess.getReadableStatusPageIds({
+        statusPageIds: [PAGE_A],
+        props: CALLER,
+      }),
+    ).toEqual([]);
+  });
+
+  test("any other failure is not swallowed", async () => {
+    findBy.mockImplementation(() => {
+      return Promise.reject(new Error("connection lost"));
+    });
+
+    await expect(
+      StatusPageReadAccess.getReadableStatusPageIds({
+        statusPageIds: [PAGE_A],
+        props: CALLER,
+      }),
+    ).rejects.toThrow("connection lost");
+  });
+
+  test("root reads every page, and nothing is asked", async () => {
+    expect(
+      await StatusPageReadAccess.getReadableStatusPageIds({
+        statusPageIds: [PAGE_A, PAGE_C],
+        props: { isRoot: true },
+      }),
+    ).toEqual([PAGE_A, PAGE_C]);
+    expect(findBy).not.toHaveBeenCalled();
+  });
+
+  test("no pages, no question", async () => {
+    expect(
+      await StatusPageReadAccess.getReadableStatusPageIds({
+        statusPageIds: [],
+        props: CALLER,
+      }),
+    ).toEqual([]);
+    expect(findBy).not.toHaveBeenCalled();
+  });
+});
+
+describe("StatusPageReadAccess.assertCallerCanPickStatusPages", () => {
+  test("pages the caller can read are fine", async () => {
+    await expect(
+      StatusPageReadAccess.assertCallerCanPickStatusPages({
+        statusPageIds: [PAGE_A],
+        props: CALLER,
+        subject: "incident",
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  test("a page the caller cannot read is refused, naming the role that fixes it", async () => {
+    await expect(
+      StatusPageReadAccess.assertCallerCanPickStatusPages({
+        statusPageIds: [PAGE_A, PAGE_B],
+        props: CALLER,
+        subject: "incident template",
+      }),
+    ).rejects.toThrow(
+      "You do not have access to some of the status pages you picked, so this incident template cannot be limited to them. Picking status pages needs a role that can read them, such as Status Page Viewer (it can be limited to pages with certain labels).",
+    );
+  });
+
+  test("the refusal is a NotAuthorizedException", async () => {
+    readable = null;
+
+    await expect(
+      StatusPageReadAccess.assertCallerCanPickStatusPages({
+        statusPageIds: [PAGE_A],
+        props: CALLER,
+        subject: "incident",
+      }),
+    ).rejects.toBeInstanceOf(NotAuthorizedException);
+  });
+
+  test("pages allowed without reading them (a template's) are not asked about", async () => {
+    await expect(
+      StatusPageReadAccess.assertCallerCanPickStatusPages({
+        statusPageIds: [PAGE_A, PAGE_C],
+        props: CALLER,
+        subject: "incident",
+        allowedStatusPageIds: [PAGE_C.toUpperCase()],
+      }),
+    ).resolves.toBeUndefined();
+
+    expect(requestedIds(findBy.mock.calls[0]![0].query)).toEqual([PAGE_A]);
+  });
+
+  test("nothing to pick, nothing asked", async () => {
+    await StatusPageReadAccess.assertCallerCanPickStatusPages({
+      statusPageIds: [],
+      props: CALLER,
+      subject: "incident",
+    });
+
+    expect(findBy).not.toHaveBeenCalled();
+  });
+
+  test("root picks any page", async () => {
+    readable = null;
+
+    await expect(
+      StatusPageReadAccess.assertCallerCanPickStatusPages({
+        statusPageIds: [PAGE_B],
+        props: { isRoot: true },
+        subject: "incident",
+      }),
+    ).resolves.toBeUndefined();
+    expect(findBy).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/StatusPage/StatusPageSubscriberUnsubscribeNotice.test.ts

@@ -0,0 +1,132 @@
+import StatusPageSubscriberUnsubscribeNotice, {
+  StatusPageSubscriberUnsubscribeNoticeEmail,
+  StatusPageSubscriberUnsubscribeNoticeInput,
+  StatusPageSubscriberUnsubscribeSource,
+} from "../../../../Server/Utils/StatusPage/StatusPageSubscriberUnsubscribeNotice";
+import { StatusPageSubscriberUnsubscribeChannel } from "../../../../Types/StatusPage/StatusPageSubscriberUnsubscribe";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The email a status page's owners (and the teammate who added the
+ * subscriber) get when a subscriber the team added unsubscribes itself - the
+ * warning that a site may just have dropped off the page.
+ *
+ * It goes out through the SimpleMessage template, which inserts `message` as
+ * HTML, and the contact in it was typed on a public form or into the
+ * dashboard, so every value must arrive escaped.
+ */
+
+const BASE: StatusPageSubscriberUnsubscribeNoticeInput = {
+  statusPageName: "Site 03",
+  contact: {
+    channel: StatusPageSubscriberUnsubscribeChannel.Email,
+    contact: "site03-all@acme.com",
+  },
+  source: StatusPageSubscriberUnsubscribeSource.UnsubscribeLink,
+  unsubscribedAt: new Date("2026-09-26T10:15:00.000Z"),
+  addedByName: "Dana Admin",
+  addedAt: new Date("2026-01-05T08:00:00.000Z"),
+  subscriberListUrl:
+    "https://oneuptime.acme.com/dashboard/p1/status-pages/s1/email-subscribers",
+};
+
+function build(
+  overrides?: Partial<StatusPageSubscriberUnsubscribeNoticeInput>,
+): StatusPageSubscriberUnsubscribeNoticeEmail {
+  return StatusPageSubscriberUnsubscribeNotice.build({
+    ...BASE,
+    ...(overrides || {}),
+  });
+}
+
+describe("StatusPageSubscriberUnsubscribeNotice.build", () => {
+  test("names the subscriber, the page, how and when it left, and who added it", () => {
+    const email: StatusPageSubscriberUnsubscribeNoticeEmail = build();
+
+    expect(email.subject).toBe(
+      "A subscriber your team added unsubscribed from Site 03",
+    );
+    expect(email.message).toContain(
+      "The email subscriber <strong>site03-all@acme.com</strong> unsubscribed from the status page <strong>Site 03</strong> using the unsubscribe link in a notification",
+    );
+    expect(email.message).toContain("Sep 26, 2026, 10:15 UTC");
+    expect(email.message).toContain("Dana Admin added this subscriber on");
+    expect(email.message).toContain("Jan 5, 2026");
+    expect(email.message).toContain(
+      `<a href="${BASE.subscriberListUrl}">View the status page's subscribers</a>`,
+    );
+  });
+
+  test("warns that a shared address drops everyone who reads it", () => {
+    expect(build().message).toContain(
+      "Anyone who reads a shared address, such as a mailing list, can unsubscribe it for everyone who reads it.",
+    );
+  });
+
+  test("says when it was the manage page rather than the link", () => {
+    expect(
+      build({
+        source: StatusPageSubscriberUnsubscribeSource.ManageSubscriptionPage,
+      }).message,
+    ).toContain("on the status page's Update Subscription page");
+  });
+
+  test("escapes every value it interpolates", () => {
+    const email: StatusPageSubscriberUnsubscribeNoticeEmail = build({
+      statusPageName: '<img src=x onerror="alert(1)">',
+      contact: {
+        channel: StatusPageSubscriberUnsubscribeChannel.Email,
+        contact: "<script>alert(2)</script>@acme.com",
+      },
+      addedByName: "<b>Eve</b> & co",
+      subscriberListUrl: 'https://x.test/"><script>alert(3)</script>',
+    });
+
+    expect(email.message).not.toContain("<script>");
+    expect(email.message).not.toContain("<img");
+    expect(email.message).not.toContain("<b>Eve</b>");
+    expect(email.message).toContain("&lt;script&gt;alert(2)&lt;/script&gt;");
+    expect(email.message).toContain("&lt;b&gt;Eve&lt;/b&gt; &amp; co");
+    expect(email.message).toContain("&quot;&gt;&lt;script&gt;");
+  });
+
+  test("still reads when the teammate or the date is unknown", () => {
+    const email: StatusPageSubscriberUnsubscribeNoticeEmail = build({
+      addedByName: undefined,
+      addedAt: undefined,
+    });
+
+    expect(email.message).toContain(
+      "Someone on your team added this subscriber.",
+    );
+  });
+
+  test("a subscriber with no contact to name is still reported", () => {
+    const email: StatusPageSubscriberUnsubscribeNoticeEmail = build({
+      contact: {
+        channel: StatusPageSubscriberUnsubscribeChannel.Slack,
+        contact: "",
+      },
+    });
+
+    expect(email.message).toContain("A Slack subscriber unsubscribed");
+  });
+
+  test.each([
+    [StatusPageSubscriberUnsubscribeChannel.Email, "email-subscribers"],
+    [StatusPageSubscriberUnsubscribeChannel.SMS, "sms-subscribers"],
+    [StatusPageSubscriberUnsubscribeChannel.Slack, "slack-subscribers"],
+    [
+      StatusPageSubscriberUnsubscribeChannel.MicrosoftTeams,
+      "microsoft-teams-subscribers",
+    ],
+    [StatusPageSubscriberUnsubscribeChannel.Webhook, "webhook-subscribers"],
+  ])(
+    "links a %s subscriber to the dashboard's %s list",
+    (channel: StatusPageSubscriberUnsubscribeChannel, route: string) => {
+      expect(
+        StatusPageSubscriberUnsubscribeNotice.getSubscriberListRoute(channel),
+      ).toBe(route);
+    },
+  );
+});

package/Tests/Server/Utils/StatusPage/StatusPageSubscriberUnsubscribeToken.test.ts

@@ -0,0 +1,155 @@
+import StatusPageSubscriberUnsubscribeToken from "../../../../Server/Utils/StatusPage/StatusPageSubscriberUnsubscribeToken";
+import StatusPageSubscriberUnsubscribe from "../../../../Types/StatusPage/StatusPageSubscriberUnsubscribe";
+import crypto from "crypto";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * The secret in a subscriber's unsubscribe link. Holding it is the whole
+ * authorisation to unsubscribe - on a private status page too, without
+ * signing in - so it has to be unguessable, and checking a guess must not
+ * tell the guesser how close it was.
+ */
+
+const TOKEN: string =
+  "3f9a1c2b4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8";
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("StatusPageSubscriberUnsubscribeToken.generate", () => {
+  test("mints 32 random bytes from the CSPRNG, as 64 hex characters", () => {
+    const randomBytes: jest.SpyInstance = jest.spyOn(crypto, "randomBytes");
+
+    const token: string = StatusPageSubscriberUnsubscribeToken.generate();
+
+    expect(randomBytes).toHaveBeenCalledWith(32);
+    expect(token).toMatch(/^[0-9a-f]{64}$/);
+    expect(StatusPageSubscriberUnsubscribe.isWellFormedToken(token)).toBe(true);
+  });
+
+  test("never repeats", () => {
+    const tokens: Set<string> = new Set<string>();
+
+    for (let i: number = 0; i < 2000; i++) {
+      tokens.add(StatusPageSubscriberUnsubscribeToken.generate());
+    }
+
+    expect(tokens.size).toBe(2000);
+  });
+
+  test("is not the six-digit subscription confirmation code", () => {
+    expect(StatusPageSubscriberUnsubscribeToken.generate()).not.toMatch(
+      /^\d{6}$/,
+    );
+  });
+});
+
+describe("StatusPageSubscriberUnsubscribeToken.matches", () => {
+  test("accepts the subscription's own token", () => {
+    expect(
+      StatusPageSubscriberUnsubscribeToken.matches({
+        stored: TOKEN,
+        presented: TOKEN,
+      }),
+    ).toBe(true);
+  });
+
+  test("accepts it in upper case, as a mail client may change it", () => {
+    expect(
+      StatusPageSubscriberUnsubscribeToken.matches({
+        stored: TOKEN,
+        presented: TOKEN.toUpperCase(),
+      }),
+    ).toBe(true);
+  });
+
+  test.each([
+    ["a different token", `${TOKEN.slice(0, 63)}0`],
+    ["the token with one character missing", TOKEN.slice(1)],
+    ["the token with a character added", `${TOKEN}0`],
+    ["nothing", ""],
+    ["null", null],
+    ["undefined", undefined],
+  ])("refuses %s", (_label: string, presented: string | null | undefined) => {
+    expect(
+      StatusPageSubscriberUnsubscribeToken.matches({
+        stored: TOKEN,
+        presented: presented,
+      }),
+    ).toBe(false);
+  });
+
+  test.each([
+    ["no stored token", null],
+    ["an empty stored token", ""],
+    ["a malformed stored token", "not-a-token"],
+  ])(
+    "refuses everything when the subscriber has %s",
+    (_label: string, stored: string | null) => {
+      expect(
+        StatusPageSubscriberUnsubscribeToken.matches({
+          stored: stored,
+          presented: TOKEN,
+        }),
+      ).toBe(false);
+      expect(
+        StatusPageSubscriberUnsubscribeToken.matches({
+          stored: stored,
+          presented: stored,
+        }),
+      ).toBe(false);
+    },
+  );
+
+  test("compares in constant time, on full-length buffers, whatever it is given", () => {
+    const timingSafeEqual: jest.SpyInstance = jest.spyOn(
+      crypto,
+      "timingSafeEqual",
+    );
+
+    const cases: Array<{
+      stored: string | null;
+      presented: string | null;
+    }> = [
+      // The right token.
+      { stored: TOKEN, presented: TOKEN },
+      // A wrong one.
+      { stored: TOKEN, presented: `${TOKEN.slice(0, 63)}0` },
+      // A short guess.
+      { stored: TOKEN, presented: "abc" },
+      // No subscriber to compare with at all.
+      { stored: null, presented: TOKEN },
+      { stored: null, presented: null },
+    ];
+
+    for (const testCase of cases) {
+      StatusPageSubscriberUnsubscribeToken.matches(testCase);
+    }
+
+    /*
+     * One constant-time comparison per check - including the ones that are
+     * refused before the bytes could ever match - and never on buffers of
+     * different lengths, which would throw.
+     */
+    expect(timingSafeEqual).toHaveBeenCalledTimes(cases.length);
+
+    for (const call of timingSafeEqual.mock.calls) {
+      const [a, b] = call as unknown as [Buffer, Buffer];
+
+      expect(a.length).toBe(64);
+      expect(b.length).toBe(64);
+    }
+  });
+
+  test("does not use a plain string comparison on the token", () => {
+    const source: string = StatusPageSubscriberUnsubscribeToken.matches
+      .toString()
+      .replace(/\s+/g, " ");
+
+    expect(source).toContain("timingSafeEqual");
+    expect(source).not.toMatch(
+      /stored\s*===\s*presented|presented\s*===\s*stored/,
+    );
+  });
+});