fix: package upgrade (#2777)

Upgraded some packages to latest. This should resolve #2774. Fixes were
also applied after types upgrades that helped discover other errors.

src/core/server/app/middleware/error.ts

@@ -1,9 +1,8 @@
 import { FluentBundle } from "@fluent/bundle/compat";
-import { ErrorRequestHandler } from "express";
 
 import { CoralError, InternalError } from "coral-server/errors";
 import { I18n } from "coral-server/services/i18n";
-import { Request } from "coral-server/types/express";
+import { ErrorRequestHandler, Request } from "coral-server/types/express";
 
 /**
  * wrapError ensures that the error being propagated is a CoralError.
@@ -45,10 +44,10 @@ export const JSONErrorHandler = (bundles?: I18n): ErrorRequestHandler => (
   next
 ) => {
   // Wrap the error if it needs to be wrapped.
-  err = wrapError(err);
+  const e = wrapError(err);
 
   // Send the response via JSON.
-  res.status(err.status).json(serializeError(err, req, bundles));
+  res.status(e.status).json(serializeError(e, req, bundles));
 };
 
 export const HTMLErrorHandler = (bundles?: I18n): ErrorRequestHandler => (
@@ -58,8 +57,8 @@ export const HTMLErrorHandler = (bundles?: I18n): ErrorRequestHandler => (
   next
 ) => {
   // Wrap the error if it needs to be wrapped.
-  err = wrapError(err);
+  const e = wrapError(err);
 
   // Send the response via HTML.
-  res.status(err.status).render("error", serializeError(err, req, bundles));
+  res.status(e.status).render("error", serializeError(e, req, bundles));
 };

src/core/server/app/middleware/passport/index.ts

@@ -286,7 +286,9 @@ export const authenticate = (
       }
 
       // Attach the user to the request.
-      req.user = user;
+      if (user) {
+        req.user = user;
+      }
 
       return next();
     }

src/core/server/app/middleware/passport/strategies/oidc/index.ts

@@ -1,6 +1,11 @@
 import Joi from "joi";
 import jwt from "jsonwebtoken";
-import jwks, { JwksClient } from "jwks-rsa";
+import jwks, {
+  CertSigningKey,
+  JwksClient,
+  RsaSigningKey,
+  SigningKey,
+} from "jwks-rsa";
 import { isNil } from "lodash";
 import { Db } from "mongodb";
 import { Strategy as OAuth2Strategy, VerifyCallback } from "passport-oauth2";
@@ -9,7 +14,6 @@ import { Strategy } from "passport-strategy";
 import { validate } from "coral-server/app/request/body";
 import { reconstructURL } from "coral-server/app/url";
 import { IntegrationDisabled, TokenInvalidError } from "coral-server/errors";
-import { GQLUSER_ROLE } from "coral-server/graph/tenant/schema/__generated__/types";
 import logger from "coral-server/logger";
 import { OIDCAuthIntegration } from "coral-server/models/settings";
 import { Tenant } from "coral-server/models/tenant";
@@ -25,6 +29,8 @@ import { findOrCreate } from "coral-server/services/users";
 import { validateUsername } from "coral-server/services/users/helpers";
 import { Request } from "coral-server/types/express";
 
+import { GQLUSER_ROLE } from "coral-server/graph/tenant/schema/__generated__/types";
+
 export interface Params {
   id_token?: string;
 }
@@ -82,6 +88,12 @@ export function isOIDCToken(token: OIDCIDToken | object): token is OIDCIDToken {
   return isNil(error);
 }
 
+function isCertSigningKey(
+  key: SigningKey | RsaSigningKey
+): key is CertSigningKey {
+  return Boolean((key as CertSigningKey).publicKey);
+}
+
 /**
  * keyFunc will provide the secret based on the given jwkw client.
  *
@@ -104,9 +116,11 @@ const signingKeyFactory = (client: jwks.JwksClient): jwt.KeyFunction => (
     }
 
     // Grab the signingKey out of the provided key.
-    const signingKey = key.publicKey || key.rsaPublicKey;
-
-    callback(null, signingKey);
+    if (isCertSigningKey(key)) {
+      return callback(null, key.publicKey);
+    } else {
+      return callback(null, key.rsaPublicKey);
+    }
   });
 };
 

src/core/server/app/url.ts

@@ -85,7 +85,7 @@ export function prefixSchemeIfRequired(secure: boolean, url: string) {
   return url;
 }
 
-export function extractParentsURL(req: Request) {
+export function extractParentsURL(req: Pick<Request, "headers" | "query">) {
   // The only two places this could be is in the referer header or the parentUrl
   // query parameter (injected by pym.js). If both of these are empty, then we
   // can't find anything.
@@ -116,7 +116,7 @@ export function extractParentsURL(req: Request) {
  *
  * @param req the request where we want to extract the parent's hostname from.
  */
-export function extractParentsOrigin(req: Request) {
+export function extractParentsOrigin(req: Pick<Request, "headers" | "query">) {
   const url = extractParentsURL(req);
   if (!url) {
     return null;

src/core/server/models/comment/comment.ts

@@ -70,7 +70,7 @@ export interface Comment extends TenantResource {
   /**
    * authorID stores the ID of the User that created this Comment.
    */
-  authorID: string;
+  authorID: string | null;
 
   /**
    * storyID stores the ID of the Story that this Comment was left on.
@@ -319,7 +319,7 @@ export async function editComment(
       status: {
         $in: EDITABLE_STATUSES,
       },
-      deletedAt: null,
+      deletedAt: undefined,
       createdAt: {
         $gt: lastEditableCommentCreatedAt,
       },

src/core/server/models/story/counts/shared.ts

@@ -154,14 +154,7 @@ export async function retrieveSharedModerationQueueQueuesCounts(
   const key = commentCountsModerationQueueQueuesKey(tenantID);
   const freshKey = freshenKey(key);
 
-  // Get the values, and the freshness key.
-  const [[, queues], [, fresh]]: [
-    [
-      Error | undefined,
-      Record<keyof CommentModerationCountsPerQueue, string> | null
-    ],
-    [Error | undefined, string | null]
-  ] = await redis
+  const [[, fresh], [, queues]] = await redis
     .pipeline()
     .hgetall(key)
     .get(freshKey)

src/core/server/models/tenant/tenant.ts

@@ -223,7 +223,10 @@ export async function retrieveTenant(mongo: Db, id: string) {
   return collection(mongo).findOne({ id });
 }
 
-export async function retrieveManyTenants(mongo: Db, ids: string[]) {
+export async function retrieveManyTenants(
+  mongo: Db,
+  ids: ReadonlyArray<string>
+) {
   const cursor = collection(mongo).find({
     id: {
       $in: ids,

src/core/server/services/notifications/categories/featured.ts

@@ -13,7 +13,7 @@ async function processor(
 ): Promise<Notification | null> {
   // Get the comment that was featured.
   const comment = await ctx.comments.load(input.commentID);
-  if (!comment || !hasPublishedStatus(comment)) {
+  if (!comment || (!hasPublishedStatus(comment) || !comment.authorID)) {
     return null;
   }
 

src/core/server/services/notifications/categories/moderation.ts

@@ -19,7 +19,7 @@ async function processor(
 
   // Load the comment in question.
   const comment = await ctx.comments.load(input.commentID);
-  if (!comment) {
+  if (!comment || !comment.authorID) {
     return null;
   }
 

src/core/server/services/notifications/categories/reply.ts

@@ -13,7 +13,7 @@ async function processor(
   input: CommentReplyCreatedInput
 ): Promise<Notification | null> {
   const comment = await ctx.comments.load(input.commentID);
-  if (!comment || !hasPublishedStatus(comment)) {
+  if (!comment || !hasPublishedStatus(comment) || !comment.authorID) {
     return null;
   }
 

src/core/server/services/notifications/categories/staffReply.ts

@@ -14,7 +14,7 @@ async function processor(
   input: CommentReplyCreatedInput
 ): Promise<Notification | null> {
   const comment = await ctx.comments.load(input.commentID);
-  if (!comment || !hasPublishedStatus(comment)) {
+  if (!comment || !hasPublishedStatus(comment) || !comment.authorID) {
     return null;
   }
 

src/core/server/services/slack/publisher.ts

@@ -78,17 +78,17 @@ async function postCommentToSlack(
   hookURL: string
 ) {
   const comment = await ctx.comments.load(commentID);
-  if (comment === null) {
-    return;
-  }
-  const story = await ctx.stories.load(comment.storyID);
-  if (story === null) {
+  if (comment === null || !comment.authorID) {
     return;
   }
   const author = await ctx.users.load(comment.authorID);
   if (author === null) {
     return;
   }
+  const story = await ctx.stories.load(comment.storyID);
+  if (story === null) {
+    return;
+  }
 
   // Get some properties about the event.
   const storyTitle = getStoryTitle(story);

src/core/server/services/users/delete.ts

@@ -1,5 +1,6 @@
 import { Collection, Db } from "mongodb";
 
+import { ACTION_TYPE } from "coral-server/models/action/comment";
 import { Story } from "coral-server/models/story";
 import collections from "coral-server/services/mongodb/collections";
 
@@ -96,7 +97,7 @@ async function deleteUserActionCounts(
   await collections.commentActions(mongo).deleteMany({
     tenantID,
     userID,
-    actionType: "REACTION",
+    actionType: ACTION_TYPE.REACTION,
   });
 }