feat: Enhance log filtering and user session management with improved encryption and suspension checks

backend/src/entities/table-logs/repository/table-logs-custom-repository-extension.ts

@@ -57,9 +57,11 @@ export const tableLogsCustomRepositoryExtension: ITableLogsRepository = {
 
 		if (!userConnectionEdit) {
 			if (userInGroupsIds.length > 0) {
-				for (const userId of userInGroupsIds) {
-					qb.orWhere('tableLogs.cognitoUserName = :userIdInAdminGroup', { userIdInAdminGroup: userId });
-				}
+				// An IN list, not a loop of orWhere. orWhere appends a top-level OR and drops the
+				// connection filter above. That leaked the logs of every connection.
+				qb.andWhere('tableLogs.cognitoUserName IN (:...userIdsInAdminGroup)', {
+					userIdsInAdminGroup: userInGroupsIds,
+				});
 			} else {
 				qb.andWhere('tableLogs.cognitoUserName = :currentUserId', { currentUserId: currentUserId });
 			}
@@ -76,9 +78,7 @@ export const tableLogsCustomRepositoryExtension: ITableLogsRepository = {
 			qb.andWhere('tableLogs.operationType = :logOperationType', { logOperationType: logOperationType });
 		}
 		if (logOperationTypes.length > 0) {
-			for (const type of logOperationTypes) {
-				qb.orWhere('tableLogs.operationType = :type', { type: type });
-			}
+			qb.andWhere('tableLogs.operationType IN (:...logOperationTypes)', { logOperationTypes });
 		}
 		const rowsCount = await qb.getCount();
 		const lastPage = Math.ceil(rowsCount / perPage);
@@ -126,9 +126,11 @@ export const tableLogsCustomRepositoryExtension: ITableLogsRepository = {
 		}
 		if (!userConnectionEdit) {
 			if (userInGroupsIds.length > 0) {
-				for (const userId of userInGroupsIds) {
-					qb.orWhere('tableLogs.cognitoUserName = :userIdInAdminGroup', { userIdInAdminGroup: userId });
-				}
+				// An IN list, not a loop of orWhere. orWhere appends a top-level OR and drops the
+				// connection filter above. That leaked the logs of every connection.
+				qb.andWhere('tableLogs.cognitoUserName IN (:...userIdsInAdminGroup)', {
+					userIdsInAdminGroup: userInGroupsIds,
+				});
 			} else {
 				qb.andWhere('tableLogs.cognitoUserName = :currentUserId', { currentUserId: currentUserId });
 			}
@@ -145,9 +147,7 @@ export const tableLogsCustomRepositoryExtension: ITableLogsRepository = {
 			qb.andWhere('tableLogs.operationType = :logOperationType', { logOperationType: logOperationType });
 		}
 		if (logOperationTypes.length > 0) {
-			for (const type of logOperationTypes) {
-				qb.orWhere('tableLogs.operationType = :type', { type: type });
-			}
+			qb.andWhere('tableLogs.operationType IN (:...logOperationTypes)', { logOperationTypes });
 		}
 
 		const offset = (page - 1) * perPage;

backend/src/entities/user/enums/jwt-scopes.enum.ts

@@ -4,4 +4,8 @@ export enum JwtScopesEnum {
 	// unconfirmed user) in rocketadmin-saas issues a token carrying this, and it is refused
 	// everywhere except the routes that complete the flow — see assertTokenScopeAllowed.
 	EMAIL_VERIFY = 'email_verify',
+	// rocketadmin-saas issues it for a support session that acts as a user. The core accepts it
+	// as a normal session today. The enum entry makes the scope visible to the core. A route
+	// can refuse it later.
+	IMPERSONATED = 'impersonated',
 }

backend/src/entities/user/user.entity.ts

@@ -55,17 +55,20 @@ export class UserEntity {
 		this.emailToLowerCase();
 	}
 
+	// The hook encrypts the OTP seed whenever it is set, not only after enrollment. Before this rule
+	// a user who never completed verify-otp kept a clear-text seed at rest (ADR 01 §5.1).
+	@BeforeInsert()
 	@BeforeUpdate()
 	encryptOtpSecretKey() {
-		if (this.isOTPEnabled && this.otpSecretKey) {
+		if (this.otpSecretKey && !Encryptor.isEncrypted(this.otpSecretKey)) {
 			this.otpSecretKey = Encryptor.encryptData(this.otpSecretKey);
 		}
 		this.emailToLowerCase();
 	}
 
 	@AfterLoad()
 	decryptOtpSecretKey() {
-		if (this.isOTPEnabled && this.otpSecretKey) {
+		if (this.otpSecretKey && Encryptor.isEncrypted(this.otpSecretKey)) {
 			this.otpSecretKey = Encryptor.decryptData(this.otpSecretKey);
 		}
 		this.emailToLowerCase();

backend/src/helpers/encryption/encryptor.ts

@@ -105,15 +105,22 @@ export class Encryptor {
 		if (data === null || data === undefined) {
 			return data;
 		}
+		// Fail closed. A return of the plaintext here stores a secret in clear text and the caller
+		// cannot tell. decryptData throws in the same case.
 		try {
 			const privateKey = Encryptor.getPrivateKey();
 			return Encryptor.encryptDataV2(data, privateKey);
 		} catch (e) {
-			console.log('-> Encryption error', e);
-			return data;
+			throw new Error('Data encryption failed with error: ' + e);
 		}
 	}
 
+	// True when the value already carries the V2 envelope. The user entity hooks use it to
+	// encrypt a value once and to skip a value that is still in clear text on load.
+	static isEncrypted(value: string): boolean {
+		return Encryptor.isV2Format(value);
+	}
+
 	static decryptData(encryptedData: string): string;
 	static decryptData(encryptedData: string | null | undefined): string | null | undefined;
 	static decryptData(encryptedData: string | null | undefined): string | null | undefined {

backend/src/microservices/saas-microservice/use-cases/saas-otp-login.use.case.ts

@@ -7,6 +7,7 @@ import { FoundUserDto } from '../../../entities/user/dto/found-user.dto.js';
 import { IOtpLogin } from '../../../entities/user/use-cases/user-use-cases.interfaces.js';
 import { UserHelperService } from '../../../entities/user/user-helper.service.js';
 import { InTransactionEnum } from '../../../enums/in-transaction.enum.js';
+import { Messages } from '../../../exceptions/text/messages.js';
 import { appConfig } from '../../../shared/config/app-config.js';
 import { SaasOtpLoginDs } from '../data-structures/saas-otp-login.ds.js';
 import { ISaasOtpLogin } from './saas-use-cases.interface.js';
@@ -68,6 +69,9 @@ export class SaasOtpLoginUseCase extends AbstractUseCase<SaasOtpLoginDs, FoundUs
 		if (!foundUser) {
 			throw new UnauthorizedException('JWT verification failed');
 		}
+		if (foundUser.suspended) {
+			throw new UnauthorizedException(Messages.ACCOUNT_SUSPENDED);
+		}
 		return await this.userHelperService.buildFoundUserDs(foundUser);
 	}
 }

backend/src/microservices/saas-microservice/use-cases/saas-usual-login.use.case.ts

@@ -1,4 +1,4 @@
-import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import { BadRequestException, Inject, Injectable, NotFoundException, UnauthorizedException } from '@nestjs/common';
 import AbstractUseCase from '../../../common/abstract-use.case.js';
 import { IGlobalDatabaseContext } from '../../../common/application/global-database-context.interface.js';
 import { BaseType } from '../../../common/data-injection.tokens.js';
@@ -76,6 +76,19 @@ export class SaasUsualLoginUseCase extends AbstractUseCase<UsualLoginDs, FoundUs
 			await this.recordSignInAudit(email, null, SignInStatusEnum.FAILED, ipAddress, userAgent, Messages.USER_NOT_FOUND);
 			throw new NotFoundException(Messages.USER_NOT_FOUND);
 		}
+		// A suspended user must not get a session. The saas never reads the `suspended` flag of the
+		// returned user, so the check has to live here, as in UsualLoginUseCase.
+		if (user.suspended) {
+			await this.recordSignInAudit(
+				email,
+				user.id,
+				SignInStatusEnum.FAILED,
+				ipAddress,
+				userAgent,
+				Messages.ACCOUNT_SUSPENDED,
+			);
+			throw new UnauthorizedException(Messages.ACCOUNT_SUSPENDED);
+		}
 		if (!userData.password) {
 			await this.recordSignInAudit(
 				email,

backend/test/ava-tests/encryptor.test.ts

@@ -4,6 +4,7 @@ import CryptoJS from 'crypto-js';
 process.env.PRIVATE_KEY = 'test-private-key-12345';
 
 const { Encryptor } = await import('../../src/helpers/encryption/encryptor.js');
+const awaitedAppConfig = await import('../../src/shared/config/app-config.js');
 
 const TEST_DATA = 'Hello, World! This is sensitive data.';
 const TEST_MASTER_PWD = 'my-secure-master-password-123';
@@ -198,3 +199,21 @@ test('hashUserPassword: should return empty string for empty password', async (t
 
 	t.is(result, '');
 });
+
+test('encryptData: throws instead of returning the plaintext when the private key is missing', (t) => {
+	const { appConfig } = awaitedAppConfig;
+	const savedKey = appConfig.auth.privateKey;
+	appConfig.auth.privateKey = null;
+	try {
+		const error = t.throws(() => Encryptor.encryptData(TEST_DATA));
+		t.true(error.message.includes('Data encryption failed'));
+		t.false(error.message.includes(TEST_DATA));
+	} finally {
+		appConfig.auth.privateKey = savedKey;
+	}
+});
+
+test('isEncrypted: true only for the V2 envelope', (t) => {
+	t.true(Encryptor.isEncrypted(Encryptor.encryptData(TEST_DATA)));
+	t.false(Encryptor.isEncrypted(TEST_DATA));
+});

backend/test/ava-tests/non-saas-tests/non-saas-table-postgres-bulk-delete-e2e.test.ts

@@ -143,6 +143,39 @@ test.serial(`${currentTest} should delete more rows than fit one statement and l
 	}
 });
 
+test.serial(`GET /logs/:connectionId with operationTypes stays inside the connection`, async (t) => {
+	// Regression for the orWhere leak: an operationTypes filter used to drop the connection filter
+	// and return the logs of every connection. The first test above left 1500 deleteRow logs on
+	// another connection of another user; this connection must report only its own.
+	const connectionToTestDB = getTestData(mockFactory).connectionToPostgres;
+	const secondUserToken = (await registerUserAndReturnUserInfo(app)).token;
+	const { testTableName } = await createTestTable(connectionToTestDB, 5);
+	const connectionId = await createConnection(secondUserToken);
+
+	const deleteResponse = await request(app.getHttpServer())
+		.put(`/table/rows/delete/${connectionId}?tableName=${testTableName}`)
+		.send([{ id: 1 }, { id: 2 }])
+		.set('Cookie', secondUserToken)
+		.set('Content-Type', 'application/json')
+		.set('Accept', 'application/json');
+	t.is(deleteResponse.status, 200, deleteResponse.text);
+
+	for (const query of ['operationTypes=deleteRow', 'operationTypes=deleteRow,addRow', '']) {
+		const logsResponse = await request(app.getHttpServer())
+			.get(`/logs/${connectionId}?page=1&perPage=50&${query}`)
+			.set('Cookie', secondUserToken)
+			.set('Content-Type', 'application/json')
+			.set('Accept', 'application/json');
+		t.is(logsResponse.status, 200, logsResponse.text);
+		const logsRO = JSON.parse(logsResponse.text);
+		t.is(logsRO.pagination.total, 2, `query "${query}" must see only this connection`);
+		t.is(logsRO.logs.length, 2);
+		for (const log of logsRO.logs) {
+			t.is(log.table_name, testTableName);
+		}
+	}
+});
+
 test.serial(`${currentTest} should delete rows of a table with a composite primary key`, async (t) => {
 	const connectionToTestDB = getTestData(mockFactory).connectionToPostgres;
 	const firstUserToken = (await registerUserAndReturnUserInfo(app)).token;

backend/test/ava-tests/saas-tests/saas-user-login-e2e.test.ts

@@ -181,3 +181,38 @@ test.serial(`${currentTest} rejects a request without a microservice JWT`, async
 	t.is(result.status, 401);
 	t.pass();
 });
+
+test.serial(`${currentTest} refuses a suspended user with 401`, async (t) => {
+	const { email, password, companyId, userId } = await createCoreUser();
+	const dataSource = app.get<DataSource>(BaseType.DATA_SOURCE);
+	await dataSource.getRepository(UserEntity).update({ id: userId }, { suspended: true });
+
+	const result = await request(app.getHttpServer())
+		.post('/saas/user/login')
+		.set('Authorization', microserviceAuthHeader())
+		.set('Content-Type', 'application/json')
+		.set('Accept', 'application/json')
+		.send({ email, password, companyId, request_domain: '127.0.0.1' });
+
+	t.is(result.status, 401, result.text);
+	t.is(Object.hasOwn(JSON.parse(result.text), 'id'), false);
+});
+
+test.serial(`${currentTest} stores the OTP seed encrypted before enrollment completes`, async (t) => {
+	const { userId } = await createCoreUser();
+	const dataSource = app.get<DataSource>(BaseType.DATA_SOURCE);
+	const userRepository = dataSource.getRepository(UserEntity);
+	const seed = 'JBSWY3DPEHPK3PXP';
+
+	// The same path as generate-otp: a save with isOTPEnabled still false.
+	const user = await userRepository.findOneByOrFail({ id: userId });
+	user.otpSecretKey = seed;
+	await userRepository.save(user);
+
+	const [raw] = await dataSource.query('SELECT "otpSecretKey" FROM "user" WHERE id = $1', [userId]);
+	t.true(String(raw.otpSecretKey).startsWith('$v2:'), 'seed at rest must carry the V2 envelope');
+	t.not(raw.otpSecretKey, seed);
+
+	const reloaded = await userRepository.findOneByOrFail({ id: userId });
+	t.is(reloaded.otpSecretKey, seed, 'the entity hook decrypts the seed on load');
+});