@oneuptime/common 11.0.0 → 11.0.2

package/Server/Utils/Telemetry/TelemetryEntity.ts

@@ -533,6 +533,70 @@ export default class TelemetryEntity {
       return { entityType: EntityType.KubernetesDeployment, id };
     },
 
+    // proxmox.cluster — proxmox.cluster.name only (see proxmoxClusterIdentity).
+    (attrs: EntityAttributes) => {
+      const id: Dictionary<string> | null =
+        TelemetryEntity.proxmoxClusterIdentity(attrs);
+      return id ? { entityType: EntityType.ProxmoxCluster, id } : null;
+    },
+
+    // proxmox.node — cluster + proxmox.node.name.
+    (attrs: EntityAttributes) => {
+      const nodeName: string | null = TelemetryEntity.str(
+        attrs,
+        "proxmox.node.name",
+      );
+      if (!nodeName) {
+        return null;
+      }
+      const id: Dictionary<string> = {
+        ...(TelemetryEntity.proxmoxClusterIdentity(attrs) || {}),
+        "proxmox.node.name": nodeName,
+      };
+      return { entityType: EntityType.ProxmoxNode, id };
+    },
+
+    /*
+     * proxmox.guest — cluster + proxmox.guest.vmid. The node name is
+     * deliberately NOT part of guest identity: vmids are cluster-unique
+     * and a live migration moves a guest between nodes without changing
+     * what it is, so folding the node in would fork the key on every
+     * migration. Guest name/type are descriptive (a guest can be renamed).
+     */
+    (attrs: EntityAttributes) => {
+      const vmid: string | null = TelemetryEntity.str(
+        attrs,
+        "proxmox.guest.vmid",
+      );
+      if (!vmid) {
+        return null;
+      }
+      const id: Dictionary<string> = {
+        ...(TelemetryEntity.proxmoxClusterIdentity(attrs) || {}),
+        "proxmox.guest.vmid": vmid,
+      };
+      return { entityType: EntityType.ProxmoxGuest, id };
+    },
+
+    /*
+     * ceph.cluster — ceph.cluster.name only. `ceph.cluster.fsid` is
+     * descriptive, not identity: the typed Postgres row (CephCluster) and
+     * the read side (`EntityKey.keyForCephCluster`) are name-based, and
+     * the fsid is only optionally stamped by the agent.
+     */
+    (attrs: EntityAttributes) => {
+      const name: string | null = TelemetryEntity.str(
+        attrs,
+        "ceph.cluster.name",
+      );
+      return name
+        ? {
+            entityType: EntityType.CephCluster,
+            id: { "ceph.cluster.name": name },
+          }
+        : null;
+    },
+
     /*
      * container — container.id. High-churn: flows as a membership key but
      * is membership-only by default (not promoted to a registry row
@@ -652,6 +716,8 @@ export default class TelemetryEntity {
       "container.image.tag",
       "container.image.tags",
     ],
+    [EntityType.ProxmoxGuest]: ["proxmox.guest.name", "proxmox.guest.type"],
+    [EntityType.CephCluster]: ["ceph.cluster.fsid"],
   };
 
   private static descriptiveAttributesFor(
@@ -739,6 +805,25 @@ export default class TelemetryEntity {
     return null;
   }
 
+  /*
+   * Proxmox cluster identity — proxmox.cluster.name only, mirroring
+   * k8sClusterIdentity above: the typed Postgres row (ProxmoxCluster) and
+   * the read side (`EntityKey.keyForProxmoxCluster`) are name-based, and
+   * the attribute is the user-configured join key our agent stamps on
+   * every resource (see Internal/Roadmap/ProxmoxCephProducts.md §1). This
+   * identity is also folded into the composite proxmox node/guest
+   * identities, which must stay name-based with it.
+   */
+  private static proxmoxClusterIdentity(
+    attrs: EntityAttributes,
+  ): Dictionary<string> | null {
+    const name: string | null = this.str(attrs, "proxmox.cluster.name");
+    if (name) {
+      return { "proxmox.cluster.name": name };
+    }
+    return null;
+  }
+
   /** Copy `key` from attrs into `id` (canonicalized) when scalar & present. */
   private static addIfPresent(
     id: Dictionary<string>,

package/Server/Utils/Telemetry.ts

@@ -24,16 +24,14 @@ import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-proto";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-proto";
 import { AWSXRayIdGenerator } from "@opentelemetry/id-generator-aws-xray";
 import { CompressionAlgorithm } from "@opentelemetry/otlp-exporter-base";
-import { Resource } from "@opentelemetry/resources";
+import { Resource, resourceFromAttributes } from "@opentelemetry/resources";
 import {
   BatchLogRecordProcessor,
   LoggerProvider,
   LogRecordProcessor,
   type LoggerProviderConfig,
 } from "@opentelemetry/sdk-logs";
-import type { Resource as LogsResource } from "@opentelemetry/sdk-logs/node_modules/@opentelemetry/resources/build/src/Resource";
 import {
-  Aggregation,
   MeterProvider,
   PeriodicExportingMetricReader,
 } from "@opentelemetry/sdk-metrics";
@@ -56,7 +54,7 @@ import GracefulShutdown, { ShutdownPriority } from "./GracefulShutdown";
 import ContextSpanProcessor from "./Telemetry/ContextSpanProcessor";
 import RuntimeMetrics from "./Telemetry/RuntimeMetrics";
 
-type ResourceWithRawAttributes = LogsResource & {
+type ResourceWithRawAttributes = Resource & {
   getRawAttributes?: () => Array<[string, AttributeValue | undefined]>;
 };
 
@@ -165,7 +163,7 @@ export default class Telemetry {
   }
 
   public static getResource(data: { serviceName: string }): Resource {
-    return new Resource({
+    return resourceFromAttributes({
       [ATTR_SERVICE_NAME]: data.serviceName,
       [ATTR_SERVICE_VERSION]: AppVersion,
       ["deployment.environment"]: Env,
@@ -203,20 +201,11 @@ export default class Telemetry {
           compression: CompressionAlgorithm.GZIP,
         }) as unknown as PushMetricExporter;
 
-        // Force an SDK-side aggregation selector that matches the modern metrics API.
-        if (
-          typeof (metricExporter as { selectAggregation?: unknown })
-            .selectAggregation === "function"
-        ) {
-          (
-            metricExporter as unknown as {
-              selectAggregation: (..._args: Array<unknown>) => Aggregation;
-            }
-          ).selectAggregation = () => {
-            return Aggregation.Default();
-          };
-        }
-
+        /*
+         * No aggregation-selector shim is needed anymore: the OTLP metric
+         * exporter and the sdk-metrics package now come from the same release
+         * line, so the exporter's default selector already matches the SDK.
+         */
         this.metricReader = new PeriodicExportingMetricReader({
           exporter: metricExporter,
         });

package/Tests/Server/API/BillingInvoiceAPI.test.ts

@@ -0,0 +1,194 @@
+import BillingInvoiceAPI from "../../../Server/API/BillingInvoiceAPI";
+import BillingInvoiceService from "../../../Server/Services/BillingInvoiceService";
+import BillingService from "../../../Server/Services/BillingService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import {
+  NextFunction,
+  OneUptimeRequest,
+  OneUptimeResponse,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { mockRouter } from "./Helpers";
+import { describe, expect, it } from "@jest/globals";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, { UserPermission } from "../../../Types/Permission";
+import BillingInvoice from "../../../Models/DatabaseModels/BillingInvoice";
+import Project from "../../../Models/DatabaseModels/Project";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendJsonObjectResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendErrorResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+  };
+});
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  return {
+    ...jest.requireActual("../../../Server/EnvironmentConfig"),
+    IsBillingEnabled: true,
+  };
+});
+
+jest.mock("../../../Server/Services/BillingInvoiceService");
+jest.mock("../../../Server/Services/BillingService");
+jest.mock("../../../Server/Services/ProjectService");
+
+describe("BillingInvoiceAPI", () => {
+  let mockRequest: OneUptimeRequest;
+  let mockResponse: OneUptimeResponse;
+  let nextFunction: NextFunction;
+
+  const projectId: ObjectID = ObjectID.generate();
+  const projectCustomerId: string = "cus_own_project";
+  const invoiceId: string = "in_123";
+
+  let project: Project;
+
+  beforeEach(() => {
+    new BillingInvoiceAPI();
+
+    project = new Project();
+    project.id = projectId;
+    project.paymentProviderCustomerId = projectCustomerId;
+    project.paymentProviderSubscriptionId = "sub_123";
+
+    jest
+      .spyOn(BillingInvoiceAPI.prototype, "getPermissionsForTenant")
+      .mockResolvedValue([
+        {
+          permission: Permission.EditInvoices,
+        } as UserPermission,
+      ]);
+
+    ProjectService.findOneById = jest.fn().mockResolvedValue(project);
+    BillingInvoiceService.findOneBy = jest
+      .fn()
+      .mockResolvedValue(new BillingInvoice());
+    BillingInvoiceService.updateOneBy = jest.fn().mockResolvedValue(undefined);
+    BillingInvoiceService.refreshSubscriptionStatus = jest
+      .fn()
+      .mockResolvedValue(undefined);
+    BillingService.payInvoice = jest.fn().mockResolvedValue({
+      id: invoiceId,
+      status: "paid",
+    });
+
+    mockRequest = {
+      tenantId: projectId,
+      body: {
+        data: {
+          paymentProviderInvoiceId: invoiceId,
+          paymentProviderCustomerId: projectCustomerId,
+        },
+      },
+    } as unknown as OneUptimeRequest;
+    mockResponse = {
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as OneUptimeResponse;
+    nextFunction = jest.fn();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("POST /billing-invoices/pay", () => {
+    it("should reject a customer id that does not belong to the project", async () => {
+      mockRequest.body["data"] = {
+        paymentProviderInvoiceId: invoiceId,
+        paymentProviderCustomerId: "cus_victim_tenant",
+      };
+
+      await mockRouter
+        .match("post", "/billing-invoices/pay")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledWith(
+        new BadDataException("Customer ID does not belong to this project"),
+      );
+      expect(BillingService.payInvoice).not.toHaveBeenCalled();
+      expect(BillingInvoiceService.updateOneBy).not.toHaveBeenCalled();
+    });
+
+    it("should reject an invoice that does not belong to the project", async () => {
+      BillingInvoiceService.findOneBy = jest.fn().mockResolvedValue(null);
+
+      await mockRouter
+        .match("post", "/billing-invoices/pay")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(BillingInvoiceService.findOneBy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: {
+            projectId: projectId,
+            paymentProviderInvoiceId: invoiceId,
+          },
+          /*
+           * ignoreHooks is required: BillingInvoiceService.onBeforeFind
+           * throws without props.tenantId and would re-sync all invoices
+           * from Stripe on every pay attempt.
+           */
+          props: expect.objectContaining({
+            ignoreHooks: true,
+          }),
+        }),
+      );
+      expect(nextFunction).toHaveBeenCalledWith(
+        new BadDataException("Invoice not found for this project"),
+      );
+      expect(BillingService.payInvoice).not.toHaveBeenCalled();
+      expect(BillingInvoiceService.updateOneBy).not.toHaveBeenCalled();
+    });
+
+    it("should pay with the project's own customer id and scope the status update to the project", async () => {
+      // body omits the customer id — the project's own customer is charged.
+      mockRequest.body["data"] = {
+        paymentProviderInvoiceId: invoiceId,
+      };
+
+      await mockRouter
+        .match("post", "/billing-invoices/pay")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(BillingService.payInvoice).toHaveBeenCalledWith(
+        projectCustomerId,
+        invoiceId,
+      );
+      expect(BillingInvoiceService.updateOneBy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: {
+            projectId: projectId,
+            paymentProviderInvoiceId: invoiceId,
+          },
+        }),
+      );
+      expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+        mockRequest,
+        mockResponse,
+      );
+    });
+  });
+});

package/Tests/Server/API/ProjectAPI.test.ts

@@ -1,4 +1,6 @@
 import ProjectAPI from "../../../Server/API/ProjectAPI";
+import BillingService from "../../../Server/Services/BillingService";
+import ProjectService from "../../../Server/Services/ProjectService";
 import TeamMemberService from "../../../Server/Services/TeamMemberService";
 import {
   NextFunction,
@@ -15,6 +17,17 @@ import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
 import Project from "../../../Models/DatabaseModels/Project";
 import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Permission, { UserPermission } from "../../../Types/Permission";
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  return {
+    ...jest.requireActual("../../../Server/EnvironmentConfig"),
+    IsBillingEnabled: true,
+  };
+});
+
+jest.mock("../../../Server/Services/BillingService");
 
 jest.mock("../../../Server/Utils/Express", () => {
   return {
@@ -216,4 +229,82 @@ describe("ProjectAPI", () => {
       expect(nextFunction).toHaveBeenCalledWith(authError);
     });
   });
+
+  describe("PUT /project/:id/change-plan", () => {
+    const planId: string = "plan_123";
+
+    const tenantMismatchError: BadDataException = new BadDataException(
+      "Project ID in the URL does not match the project the request is authenticated for",
+    );
+
+    beforeEach(() => {
+      ProjectService.findOneById = jest.fn().mockResolvedValue({
+        paymentProviderCustomerId: "cus_123",
+      } as Project);
+      ProjectService.changePlan = jest.fn().mockResolvedValue(undefined);
+      BillingService.hasPaymentMethods = jest.fn().mockResolvedValue(true);
+    });
+
+    it("should reject when the URL project id does not match the authenticated tenant", async () => {
+      const victimProjectId: ObjectID = ObjectID.generate();
+      const attackerProjectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: victimProjectId.toString() };
+      mockRequest.tenantId = attackerProjectId;
+      mockRequest.body = { data: { paymentProviderPlanId: planId } };
+
+      await mockRouter
+        .match("put", "/project/:id/change-plan")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledWith(tenantMismatchError);
+      expect(ProjectService.changePlan).not.toHaveBeenCalled();
+      // the foreign project must not even be looked up.
+      expect(ProjectService.findOneById).not.toHaveBeenCalled();
+    });
+
+    it("should reject when the request has no authenticated tenant", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.body = { data: { paymentProviderPlanId: planId } };
+
+      await mockRouter
+        .match("put", "/project/:id/change-plan")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledWith(tenantMismatchError);
+      expect(ProjectService.changePlan).not.toHaveBeenCalled();
+    });
+
+    it("should change the plan of the authenticated tenant's own project", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = { data: { paymentProviderPlanId: planId } };
+
+      jest
+        .spyOn(ProjectAPI.prototype, "getPermissionsForTenant")
+        .mockResolvedValue([
+          {
+            permission: Permission.ProjectOwner,
+          } as UserPermission,
+        ]);
+
+      await mockRouter
+        .match("put", "/project/:id/change-plan")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(ProjectService.changePlan).toHaveBeenCalledWith({
+        projectId: projectId,
+        paymentProviderPlanId: planId,
+      });
+      expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+        mockRequest,
+        mockResponse,
+      );
+    });
+  });
 });

package/Tests/Server/API/ResellerPlanAPI.test.ts

@@ -0,0 +1,207 @@
+import ResellerPlanAPI from "../../../Server/API/ResellerPlanAPI";
+import ProjectService from "../../../Server/Services/ProjectService";
+import ResellerPlanService from "../../../Server/Services/ResellerPlanService";
+import {
+  NextFunction,
+  OneUptimeRequest,
+  OneUptimeResponse,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { mockRouter } from "./Helpers";
+import { describe, expect, it } from "@jest/globals";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import Project from "../../../Models/DatabaseModels/Project";
+import ResellerPlan from "../../../Models/DatabaseModels/ResellerPlan";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendJsonObjectResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendErrorResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+  };
+});
+
+jest.mock("../../../Server/Services/ResellerPlanService");
+jest.mock("../../../Server/Services/ProjectService");
+jest.mock("../../../Server/Services/BillingService");
+jest.mock("../../../Server/Services/PromoCodeService");
+
+describe("ResellerPlanAPI", () => {
+  let mockRequest: OneUptimeRequest;
+  let mockResponse: OneUptimeResponse;
+  let nextFunction: NextFunction;
+
+  const resellerExternalId: string = "reseller_a";
+  const resellerObjectId: ObjectID = ObjectID.generate();
+  const resellerPlanObjectId: ObjectID = ObjectID.generate();
+  const projectObjectId: ObjectID = ObjectID.generate();
+  const licenseKey: string = "license_123";
+
+  const mockResellerPlan: ResellerPlan = {
+    id: resellerPlanObjectId,
+    planId: "plan_basic",
+    reseller: {
+      id: resellerObjectId,
+      resellerId: resellerExternalId,
+    },
+    monitorLimit: 10,
+    teamMemberLimit: 5,
+  } as unknown as ResellerPlan;
+
+  beforeEach(() => {
+    new ResellerPlanAPI();
+
+    ResellerPlanService.findOneBy = jest
+      .fn()
+      .mockResolvedValue(mockResellerPlan);
+    ProjectService.findOneBy = jest.fn().mockResolvedValue(null);
+    ProjectService.updateOneById = jest.fn().mockResolvedValue(undefined);
+    ProjectService.deleteOneBy = jest.fn().mockResolvedValue(undefined);
+
+    mockRequest = {
+      params: { resellerId: resellerExternalId },
+      bearerTokenData: { resellerId: resellerExternalId },
+      body: {
+        action: "enhance_tier",
+        plan_id: "plan_basic",
+        uuid: licenseKey,
+        activation_email: "customer@example.com",
+      },
+    } as unknown as OneUptimeRequest;
+    mockResponse = {
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as OneUptimeResponse;
+    nextFunction = jest.fn();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("POST /reseller-plan/action/:resellerId", () => {
+    it("should scope the project lookup to the authenticated reseller on tier change", async () => {
+      await mockRouter
+        .match("post", "/reseller-plan/action/:resellerId")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(ProjectService.findOneBy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: {
+            resellerLicenseId: licenseKey,
+            resellerId: resellerObjectId,
+          },
+        }),
+      );
+      // license key belongs to another reseller -> scoped lookup finds nothing.
+      expect(nextFunction).toHaveBeenCalledWith(
+        new BadDataException("Project not found with this license key"),
+      );
+      expect(ProjectService.updateOneById).not.toHaveBeenCalled();
+    });
+
+    it("should not delete another reseller's project on refund", async () => {
+      mockRequest.body["action"] = "refund";
+
+      await mockRouter
+        .match("post", "/reseller-plan/action/:resellerId")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(ProjectService.findOneBy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: {
+            resellerLicenseId: licenseKey,
+            resellerId: resellerObjectId,
+          },
+        }),
+      );
+      expect(ProjectService.deleteOneBy).not.toHaveBeenCalled();
+      // refund is idempotent: respond as refunded without deleting anything.
+      expect(Response.sendJsonObjectResponse).toHaveBeenCalledWith(
+        mockRequest,
+        mockResponse,
+        {
+          message: "product refunded",
+        },
+      );
+    });
+
+    it("should update limits for the owning reseller's project", async () => {
+      ProjectService.findOneBy = jest.fn().mockResolvedValue({
+        id: projectObjectId,
+      } as Project);
+
+      await mockRouter
+        .match("post", "/reseller-plan/action/:resellerId")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(ProjectService.updateOneById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: projectObjectId,
+          data: {
+            activeMonitorsLimit: 10,
+            seatLimit: 5,
+            resellerPlanId: resellerPlanObjectId,
+          },
+        }),
+      );
+      expect(Response.sendJsonObjectResponse).toHaveBeenCalledWith(
+        mockRequest,
+        mockResponse,
+        {
+          message: "product enhanced",
+        },
+      );
+    });
+
+    it("should delete the owning reseller's project on refund with a reseller-scoped query", async () => {
+      mockRequest.body["action"] = "refund";
+      ProjectService.findOneBy = jest.fn().mockResolvedValue({
+        id: projectObjectId,
+      } as Project);
+
+      await mockRouter
+        .match("post", "/reseller-plan/action/:resellerId")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(ProjectService.deleteOneBy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: {
+            resellerLicenseId: licenseKey,
+            resellerId: resellerObjectId,
+            _id: projectObjectId.toString(),
+          },
+        }),
+      );
+      expect(Response.sendJsonObjectResponse).toHaveBeenCalledWith(
+        mockRequest,
+        mockResponse,
+        {
+          message: "product refunded",
+        },
+      );
+    });
+  });
+});