@tiledesk/tiledesk-server 2.23.0 → 2.23.1

package/CHANGELOG.md

@@ -6,6 +6,9 @@
 (https://www.npmjs.com/package/@tiledesk/tiledesk-server/v/2.3.77) 
 
 # 2.23.1
+- Restored cross-project access for global subscriptions (`id_project: '*'` or `global: true`); bots and project-bound subscriptions remain scoped to their own project
+
+# 2.23.0
 - Deprecated JWT helper routes (`/jwt/decode`, `/jwt/generatetestjwt`); they now return 410
 - Restricted bot and subscription tokens to their own project (cross-project access denied)
 - Improved error response sanitization for integration routes

package/middleware/has-role.js

@@ -44,6 +44,9 @@ class RoleChecker {
         if (!user || user.id_project == null || projectid == null) {
           return false;
         }
+        if (!(user instanceof Faq_kb) && (String(user.id_project) === '*' || user.global === true)) {
+          return true;
+        }
         return String(user.id_project) === String(projectid);
       }
 

package/middleware/passport.js

@@ -321,7 +321,7 @@ module.exports = function(passport) {
 
     } else if (subject=="subscription") {
     
-      Subscription.findOne({_id: identifier}, function(err, subscription) {
+      Subscription.findOne({_id: identifier}).select('+global').exec(function(err, subscription) {
         if (err) {
           winston.error("Passport JWT subscription err", err);
           return done(err, false);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tiledesk/tiledesk-server",
   "description": "The Tiledesk server module",
-  "version": "2.23.0",
+  "version": "2.23.1",
   "scripts": {
     "start": "node ./bin/www",
     "pretest": "mongodb-runner start",

package/routes/authtestWithRoleCheck.js

@@ -15,6 +15,12 @@ router.get('/',  function (req, res) {
      function (req, res) {
     res.send('{"success":true}');
   });
+
+  router.get('/subscription', [
+    roleChecker.hasRoleOrTypes(null,['subscription'])],
+     function (req, res) {
+    res.send('{"success":true}');
+  });
   
   router.get('/noentitycheck', 
     [noentitycheck,

package/test/authenticationJwt.js

@@ -20,6 +20,7 @@ var assert = chai.assert;
 var jwt = require('jsonwebtoken');
 var config = require('../config/database'); // get db config file
 var faqService = require('../services/faqService');
+var Subscription = require('../models/subscription');
 
 let log = false;
 
@@ -403,6 +404,125 @@ describe('AuthenticationJWT', () => {
         });
     });
 
+    it('subscriptionJwt-wildcard-id-project-can-access-specific-project', (done) => {
+
+        var email = "test-signup-" + Date.now() + "@email.com";
+        var pwd = "pwd";
+
+        userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
+            projectService.create("test-sub-wildcard-project", savedUser._id).then(function (savedProject) {
+                var subscription = new Subscription({
+                    event: "queues.request.create." + Date.now(),
+                    target: "https://queues.example.com/hook",
+                    id_project: "*",
+                    createdBy: savedUser._id
+                });
+                subscription.save(function (err, savedSub) {
+                    if (err) { console.error("err: ", err); return done(err); }
+
+                    var signOptions = {
+                        subject: 'subscription',
+                        audience: 'https://tiledesk.com/subscriptions/' + savedSub._id,
+                    };
+                    var jwtToken = jwt.sign(savedSub.toObject(), savedSub.secret, signOptions);
+
+                    chai.request(server)
+                        .get('/' + savedProject._id + '/authtestWithRoleCheck/subscription')
+                        .set('Authorization', 'JWT ' + jwtToken)
+                        .send()
+                        .end((err, res) => {
+                            if (err) { console.error("err: ", err); }
+                            if (log) { console.log("res.body", res.body); }
+
+                            res.should.have.status(200);
+                            done();
+                        });
+                });
+            });
+        });
+    }).timeout(20000);
+
+    it('subscriptionJwt-global-true-can-access-specific-project', (done) => {
+
+        var email = "test-signup-" + Date.now() + "@email.com";
+        var pwd = "pwd";
+
+        userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
+            projectService.create("test-sub-global-a", savedUser._id).then(function (projectA) {
+                projectService.create("test-sub-global-b", savedUser._id).then(function (projectB) {
+                    var subscription = new Subscription({
+                        event: "queues.global." + Date.now(),
+                        target: "https://queues.example.com/hook",
+                        id_project: projectA._id,
+                        global: true,
+                        createdBy: savedUser._id
+                    });
+                    subscription.save(function (err, savedSub) {
+                        if (err) { console.error("err: ", err); return done(err); }
+
+                        var signOptions = {
+                            subject: 'subscription',
+                            audience: 'https://tiledesk.com/subscriptions/' + savedSub._id,
+                        };
+                        var jwtToken = jwt.sign(savedSub.toObject(), savedSub.secret, signOptions);
+
+                        chai.request(server)
+                            .get('/' + projectB._id + '/authtestWithRoleCheck/subscription')
+                            .set('Authorization', 'JWT ' + jwtToken)
+                            .send()
+                            .end((err, res) => {
+                                if (err) { console.error("err: ", err); }
+                                if (log) { console.log("res.body", res.body); }
+
+                                res.should.have.status(200);
+                                done();
+                            });
+                    });
+                });
+            });
+        });
+    }).timeout(20000);
+
+    it('subscriptionJwt-denied-cross-project', (done) => {
+
+        var email = "test-signup-" + Date.now() + "@email.com";
+        var pwd = "pwd";
+
+        userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
+            projectService.create("test-sub-project-a", savedUser._id).then(function (projectA) {
+                projectService.create("test-sub-project-b", savedUser._id).then(function (projectB) {
+                    var subscription = new Subscription({
+                        event: "webhook.request.create." + Date.now(),
+                        target: "https://hooks.example.com/hook",
+                        id_project: projectA._id,
+                        createdBy: savedUser._id
+                    });
+                    subscription.save(function (err, savedSub) {
+                        if (err) { console.error("err: ", err); return done(err); }
+
+                        var signOptions = {
+                            subject: 'subscription',
+                            audience: 'https://tiledesk.com/subscriptions/' + savedSub._id,
+                        };
+                        var jwtToken = jwt.sign(savedSub.toObject(), savedSub.secret, signOptions);
+
+                        chai.request(server)
+                            .get('/' + projectB._id + '/authtestWithRoleCheck/subscription')
+                            .set('Authorization', 'JWT ' + jwtToken)
+                            .send()
+                            .end((err, res) => {
+                                if (err) { console.error("err: ", err); }
+                                if (log) { console.log("res.body", res.body); }
+
+                                res.should.have.status(403);
+                                done();
+                            });
+                    });
+                });
+            });
+        });
+    }).timeout(20000);
+
     it('botJwt-denied-cross-project', (done) => {
 
         var email = "test-signup-" + Date.now() + "@email.com";

package/test/hasRole.js

@@ -0,0 +1,127 @@
+process.env.NODE_ENV = 'test';
+process.env.LOG_LEVEL = 'critical';
+
+const { expect } = require('chai');
+const roleChecker = require('../middleware/has-role');
+const Subscription = require('../models/subscription');
+const Faq_kb = require('../models/faq_kb');
+
+describe('RoleChecker.belongsToProject', () => {
+
+    const projectA = '6565047fdd64fd001323f37c';
+    const projectB = '507f1f77bcf86cd799439011';
+
+    it('fails closed when user, id_project or projectid is missing', () => {
+        expect(roleChecker.belongsToProject(null, projectA)).to.equal(false);
+        expect(roleChecker.belongsToProject({}, projectA)).to.equal(false);
+        expect(roleChecker.belongsToProject(new Subscription({ event: 'e', target: 't', createdBy: 'u' }), projectA)).to.equal(false);
+        expect(roleChecker.belongsToProject(new Subscription({ event: 'e', target: 't', id_project: projectA, createdBy: 'u' }), null)).to.equal(false);
+    });
+
+    it('allows a subscription with id_project "*" to access a specific projectid', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://queues.example.com',
+            id_project: '*',
+            createdBy: 'queues'
+        });
+        expect(roleChecker.belongsToProject(subscription, projectA)).to.equal(true);
+    });
+
+    it('allows a subscription with global: true to access a specific projectid', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://queues.example.com',
+            id_project: projectA,
+            global: true,
+            createdBy: 'queues'
+        });
+        expect(roleChecker.belongsToProject(subscription, projectB)).to.equal(true);
+    });
+
+    it('denies a subscription bound to project A from accessing project B', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://hooks.example.com',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        expect(roleChecker.belongsToProject(subscription, projectB)).to.equal(false);
+        expect(roleChecker.belongsToProject(subscription, projectA)).to.equal(true);
+    });
+
+    it('denies a bot for project A from accessing project B', () => {
+        const bot = new Faq_kb({
+            name: 'testbot',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        expect(roleChecker.belongsToProject(bot, projectB)).to.equal(false);
+        expect(roleChecker.belongsToProject(bot, projectA)).to.equal(true);
+    });
+
+    it('does not give bots a wildcard even if id_project is "*" or global is true', () => {
+        const wildcardBot = new Faq_kb({
+            name: 'wildcard-bot',
+            id_project: '*',
+            createdBy: 'user1'
+        });
+        expect(roleChecker.belongsToProject(wildcardBot, projectA)).to.equal(false);
+
+        const globalBot = new Faq_kb({
+            name: 'global-bot',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        globalBot.set('global', true);
+        expect(roleChecker.belongsToProject(globalBot, projectB)).to.equal(false);
+    });
+});
+
+describe('RoleChecker.isTypeAsFunction', () => {
+
+    const projectA = '6565047fdd64fd001323f37c';
+    const projectB = '507f1f77bcf86cd799439011';
+
+    it('allows a subscription with id_project "*" to access a specific projectid', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://queues.example.com',
+            id_project: '*',
+            createdBy: 'queues'
+        });
+        expect(roleChecker.isTypeAsFunction('subscription', subscription, projectA)).to.equal(true);
+    });
+
+    it('allows a subscription with global: true to access a specific projectid', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://queues.example.com',
+            id_project: projectA,
+            global: true,
+            createdBy: 'queues'
+        });
+        expect(roleChecker.isTypeAsFunction('subscription', subscription, projectB)).to.equal(true);
+    });
+
+    it('denies a subscription bound to project A from accessing project B', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://hooks.example.com',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        expect(roleChecker.isTypeAsFunction('subscription', subscription, projectB)).to.equal(false);
+        expect(roleChecker.isTypeAsFunction('subscription', subscription, projectA)).to.equal(true);
+    });
+
+    it('denies a bot for project A from accessing project B', () => {
+        const bot = new Faq_kb({
+            name: 'testbot',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        expect(roleChecker.isTypeAsFunction('bot', bot, projectB)).to.equal(false);
+        expect(roleChecker.isTypeAsFunction('bot', bot, projectA)).to.equal(true);
+    });
+});