@oneuptime/common 11.0.2 → 11.0.4

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -1,4 +1,5 @@
 import CephCluster from "../../../Models/DatabaseModels/CephCluster";
+import DockerSwarmCluster from "../../../Models/DatabaseModels/DockerSwarmCluster";
 import DockerHost from "../../../Models/DatabaseModels/DockerHost";
 import Host from "../../../Models/DatabaseModels/Host";
 import Incident from "../../../Models/DatabaseModels/Incident";
@@ -9,6 +10,7 @@ import KubernetesCluster from "../../../Models/DatabaseModels/KubernetesCluster"
 import Label from "../../../Models/DatabaseModels/Label";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import OnCallDutyPolicy from "../../../Models/DatabaseModels/OnCallDutyPolicy";
+import PodmanHost from "../../../Models/DatabaseModels/PodmanHost";
 import ProxmoxCluster from "../../../Models/DatabaseModels/ProxmoxCluster";
 import Service from "../../../Models/DatabaseModels/Service";
 import Includes from "../../../Types/BaseDatabase/Includes";
@@ -27,6 +29,7 @@ import DockerHostService from "../../Services/DockerHostService";
 import HostService from "../../Services/HostService";
 import IncidentService from "../../Services/IncidentService";
 import KubernetesClusterService from "../../Services/KubernetesClusterService";
+import PodmanHostService from "../../Services/PodmanHostService";
 import ProxmoxClusterService from "../../Services/ProxmoxClusterService";
 import ServiceService from "../../Services/ServiceService";
 import IncidentSeverityService from "../../Services/IncidentSeverityService";
@@ -577,6 +580,7 @@ export default class MonitorIncident {
     const [
       resolvedHosts,
       resolvedDockerHosts,
+      resolvedPodmanHosts,
       resolvedClusters,
       resolvedServices,
       resolvedProxmoxClusters,
@@ -596,6 +600,13 @@ export default class MonitorIncident {
         projectId: input.projectId,
         findBy: DockerHostService.findBy.bind(DockerHostService),
       }),
+      this.resolveResourceIds({
+        ids: refs.podmanHostIds,
+        names: refs.podmanHostNames,
+        nameColumn: "hostIdentifier",
+        projectId: input.projectId,
+        findBy: PodmanHostService.findBy.bind(PodmanHostService),
+      }),
       this.resolveResourceIds({
         ids: refs.kubernetesClusterIds,
         names: refs.kubernetesClusterNames,
@@ -642,6 +653,15 @@ export default class MonitorIncident {
         },
       );
     }
+    if (resolvedPodmanHosts.length > 0) {
+      input.incident.podmanHosts = resolvedPodmanHosts.map(
+        (id: string): PodmanHost => {
+          const podmanHost: PodmanHost = new PodmanHost();
+          podmanHost._id = id;
+          return podmanHost;
+        },
+      );
+    }
     if (resolvedClusters.length > 0) {
       input.incident.kubernetesClusters = resolvedClusters.map(
         (id: string): KubernetesCluster => {
@@ -735,6 +755,31 @@ export default class MonitorIncident {
 
       input.incident.cephClusters = merged;
     }
+
+    if (input.clusterContext.dockerSwarmClusterIds.length > 0) {
+      const existingIds: Set<string> = new Set<string>(
+        (input.incident.dockerSwarmClusters || []).map(
+          (cluster: DockerSwarmCluster) => {
+            return String(cluster._id);
+          },
+        ),
+      );
+
+      const merged: Array<DockerSwarmCluster> = [
+        ...(input.incident.dockerSwarmClusters || []),
+      ];
+
+      for (const id of input.clusterContext.dockerSwarmClusterIds) {
+        if (existingIds.has(id)) {
+          continue;
+        }
+        const cluster: DockerSwarmCluster = new DockerSwarmCluster();
+        cluster._id = id;
+        merged.push(cluster);
+      }
+
+      input.incident.dockerSwarmClusters = merged;
+    }
   }
 
   /*

package/Server/Utils/Monitor/MonitorMaintenanceSuppression.ts

@@ -23,6 +23,7 @@ export interface ResourceKeySet {
 export interface MaintainedResourceKeys {
   hosts: ResourceKeySet;
   dockerHosts: ResourceKeySet;
+  podmanHosts: ResourceKeySet;
   kubernetesClusters: ResourceKeySet;
   /*
    * Proxmox/Ceph clusters have no `oneuptime.*.id` label stamp, so only
@@ -112,6 +113,11 @@ export default class MonitorMaintenanceSuppression {
           refs.dockerHostNames,
           input.maintained.dockerHosts.names,
         ) ||
+        this.intersects(refs.podmanHostIds, input.maintained.podmanHosts.ids) ||
+        this.intersects(
+          refs.podmanHostNames,
+          input.maintained.podmanHosts.names,
+        ) ||
         this.intersects(
           refs.kubernetesClusterIds,
           input.maintained.kubernetesClusters.ids,
@@ -156,6 +162,8 @@ export default class MonitorMaintenanceSuppression {
       maintained.hosts.names.size > 0 ||
       maintained.dockerHosts.ids.size > 0 ||
       maintained.dockerHosts.names.size > 0 ||
+      maintained.podmanHosts.ids.size > 0 ||
+      maintained.podmanHosts.names.size > 0 ||
       maintained.kubernetesClusters.ids.size > 0 ||
       maintained.kubernetesClusters.names.size > 0 ||
       maintained.proxmoxClusters.ids.size > 0 ||
@@ -181,6 +189,7 @@ export default class MonitorMaintenanceSuppression {
     const maintained: MaintainedResourceKeys = {
       hosts: { ids: new Set<string>(), names: new Set<string>() },
       dockerHosts: { ids: new Set<string>(), names: new Set<string>() },
+      podmanHosts: { ids: new Set<string>(), names: new Set<string>() },
       kubernetesClusters: { ids: new Set<string>(), names: new Set<string>() },
       proxmoxClusters: { ids: new Set<string>(), names: new Set<string>() },
       cephClusters: { ids: new Set<string>(), names: new Set<string>() },
@@ -199,6 +208,7 @@ export default class MonitorMaintenanceSuppression {
           _id: true,
           hosts: { _id: true, hostIdentifier: true },
           dockerHosts: { _id: true, hostIdentifier: true },
+          podmanHosts: { _id: true, hostIdentifier: true },
           kubernetesClusters: { _id: true, clusterIdentifier: true },
           proxmoxClusters: { _id: true, name: true },
           cephClusters: { _id: true, name: true },
@@ -222,6 +232,13 @@ export default class MonitorMaintenanceSuppression {
           dockerHost.hostIdentifier,
         );
       }
+      for (const podmanHost of event.podmanHosts || []) {
+        this.addKey(
+          maintained.podmanHosts,
+          podmanHost._id,
+          podmanHost.hostIdentifier,
+        );
+      }
       for (const cluster of event.kubernetesClusters || []) {
         this.addKey(
           maintained.kubernetesClusters,

package/Server/Utils/Monitor/MonitorTemplateUtil.ts

@@ -361,6 +361,9 @@ export default class MonitorTemplateUtil {
         data.monitorType === MonitorType.Metrics ||
         data.monitorType === MonitorType.Kubernetes ||
         data.monitorType === MonitorType.Docker ||
+        data.monitorType === MonitorType.Host ||
+        data.monitorType === MonitorType.Podman ||
+        data.monitorType === MonitorType.DockerSwarm ||
         data.monitorType === MonitorType.Proxmox ||
         data.monitorType === MonitorType.Ceph
       ) {

package/Server/Utils/Monitor/SeriesResourceLabels.ts

@@ -48,6 +48,22 @@ export const DockerHostNameLabelKeys: ReadonlyArray<string> = [
   "oneuptime.docker.host.name",
 ];
 
+/*
+ * For Podman hosts we deliberately ignore raw `host.name` /
+ * `oneuptime.host.name`: those are the Host's territory. The ingest
+ * pipeline stamps `oneuptime.podman.host.*` independently when the
+ * source is a podman host, so only those keys identify a PodmanHost.
+ */
+export const PodmanHostIdLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.podman.host.id",
+  "oneuptime.podman.host.id",
+];
+
+export const PodmanHostNameLabelKeys: ReadonlyArray<string> = [
+  "resource.oneuptime.podman.host.name",
+  "oneuptime.podman.host.name",
+];
+
 export const KubernetesClusterIdLabelKeys: ReadonlyArray<string> = [
   "resource.oneuptime.kubernetes.cluster.id",
   "oneuptime.kubernetes.cluster.id",
@@ -112,6 +128,8 @@ export interface SeriesResourceRefs {
   hostNames: Array<string>;
   dockerHostIds: Array<string>;
   dockerHostNames: Array<string>;
+  podmanHostIds: Array<string>;
+  podmanHostNames: Array<string>;
   kubernetesClusterIds: Array<string>;
   kubernetesClusterNames: Array<string>;
   proxmoxClusterNames: Array<string>;
@@ -166,6 +184,14 @@ export default class SeriesResourceLabels {
         seriesLabels,
         DockerHostNameLabelKeys,
       ),
+      podmanHostIds: this.collectLabelValues(
+        seriesLabels,
+        PodmanHostIdLabelKeys,
+      ),
+      podmanHostNames: this.collectLabelValues(
+        seriesLabels,
+        PodmanHostNameLabelKeys,
+      ),
       kubernetesClusterIds: this.collectLabelValues(
         seriesLabels,
         KubernetesClusterIdLabelKeys,

package/Server/Utils/Telemetry/ResourceFacetResolver.ts

@@ -5,6 +5,7 @@ import MultiSearch from "../../../Types/BaseDatabase/MultiSearch";
 import ServiceModel from "../../../Models/DatabaseModels/Service";
 import HostModel from "../../../Models/DatabaseModels/Host";
 import DockerHostModel from "../../../Models/DatabaseModels/DockerHost";
+import PodmanHostModel from "../../../Models/DatabaseModels/PodmanHost";
 import KubernetesClusterModel from "../../../Models/DatabaseModels/KubernetesCluster";
 import ServerlessFunctionModel from "../../../Models/DatabaseModels/ServerlessFunction";
 import CloudResourceModel from "../../../Models/DatabaseModels/CloudResource";
@@ -12,6 +13,7 @@ import RumApplicationModel from "../../../Models/DatabaseModels/RumApplication";
 import ServiceService from "../../Services/ServiceService";
 import HostService from "../../Services/HostService";
 import DockerHostService from "../../Services/DockerHostService";
+import PodmanHostService from "../../Services/PodmanHostService";
 import KubernetesClusterService from "../../Services/KubernetesClusterService";
 import ServerlessFunctionService from "../../Services/ServerlessFunctionService";
 import CloudResourceService from "../../Services/CloudResourceService";
@@ -34,6 +36,7 @@ export const RESOURCE_FACET_KEYS: ReadonlySet<string> = new Set([
   "serviceId",
   "hostId",
   "dockerHostId",
+  "podmanHostId",
   "kubernetesClusterId",
   "serverlessFunctionId",
   "cloudResourceId",
@@ -118,6 +121,13 @@ export default class ResourceFacetResolver {
           searchText,
           limit,
         );
+      case "podmanHostId":
+        return ResourceFacetResolver.queryPodmanHosts(
+          projectId,
+          spec.counts,
+          searchText,
+          limit,
+        );
       case "kubernetesClusterId":
         return ResourceFacetResolver.queryKubernetesClusters(
           projectId,
@@ -260,6 +270,45 @@ export default class ResourceFacetResolver {
     );
   }
 
+  private static async queryPodmanHosts(
+    projectId: ObjectID,
+    counts: Map<string, number>,
+    searchText: string | undefined,
+    limit: number,
+  ): Promise<Array<ResolvedFacetValue>> {
+    const query: Record<string, unknown> = { projectId };
+    if (searchText) {
+      query["name"] = new MultiSearch({
+        fields: ["name", "hostIdentifier"],
+        value: searchText,
+      });
+    }
+
+    const podmanHosts: Array<PodmanHostModel> = await PodmanHostService.findBy({
+      query: query as any,
+      select: {
+        _id: true,
+        name: true,
+        hostIdentifier: true,
+      },
+      limit: new PositiveNumber(limit),
+      skip: new PositiveNumber(0),
+      props: { isRoot: true },
+    });
+
+    return ResourceFacetResolver.mergeCounts(
+      podmanHosts.map(
+        (p: PodmanHostModel): { id: string; displayName: string } => {
+          return {
+            id: p._id ? p._id.toString() : "",
+            displayName: p.name || p.hostIdentifier || "Unknown",
+          };
+        },
+      ),
+      counts,
+    );
+  }
+
   private static async queryKubernetesClusters(
     projectId: ObjectID,
     counts: Map<string, number>,

package/Server/Utils/Telemetry/Telemetry.ts

@@ -163,6 +163,16 @@ export default class TelemetryUtil {
     };
   }
 
+  public static getAttributesForPodmanHostIdAndHostName(data: {
+    podmanHostId: ObjectID;
+    hostName: string;
+  }): Dictionary<AttributeType> {
+    return {
+      "oneuptime.podman.host.id": data.podmanHostId.toString(),
+      "oneuptime.podman.host.name": data.hostName,
+    };
+  }
+
   public static getAttributesForKubernetesClusterIdAndName(data: {
     kubernetesClusterId: ObjectID;
     clusterName: string;

package/Server/Utils/Telemetry/TelemetryEntity.ts

@@ -597,6 +597,28 @@ export default class TelemetryEntity {
         : null;
     },
 
+    /*
+     * docker.swarm.cluster — docker.swarm.cluster.name only, mirroring the
+     * proxmox/ceph cluster identity: the typed Postgres row
+     * (DockerSwarmCluster) and the read side
+     * (`EntityKey.keyForDockerSwarmCluster`) are name-based, and the agent
+     * stamps `docker.swarm.cluster.name` on every signal. Node/Service/Task
+     * identity is NOT derived from resource attributes (inventory arrives as
+     * separate JSON-line log records), so only the cluster entity flows here.
+     */
+    (attrs: EntityAttributes) => {
+      const name: string | null = TelemetryEntity.str(
+        attrs,
+        "docker.swarm.cluster.name",
+      );
+      return name
+        ? {
+            entityType: EntityType.DockerSwarmCluster,
+            id: { "docker.swarm.cluster.name": name },
+          }
+        : null;
+    },
+
     /*
      * container — container.id. High-churn: flows as a membership key but
      * is membership-only by default (not promoted to a registry row

package/Server/Utils/ValidateGlobalProviderProjectTeams.ts

@@ -0,0 +1,119 @@
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import Project from "../../Models/DatabaseModels/Project";
+import Team from "../../Models/DatabaseModels/Team";
+import QueryHelper from "../Types/Database/QueryHelper";
+import TeamService from "../Services/TeamService";
+
+/*
+ * The Admin Dashboard attach form submits the chosen project via the `project`
+ * relation, not the `projectId` FK: the entity dropdown sets the related
+ * Project (as a model with only `_id`), so `createBy.data.projectId` is
+ * undefined at create-hook time. Resolve the FK from either shape so the hook
+ * can populate the NOT NULL `projectId` column and validate teams against it.
+ */
+export const resolveAttachmentProjectId: (data: {
+  projectId?: ObjectID | undefined;
+  project?: Project | undefined;
+}) => ObjectID | undefined = (data: {
+  projectId?: ObjectID | undefined;
+  project?: Project | undefined;
+}): ObjectID | undefined => {
+  if (data.projectId) {
+    return data.projectId;
+  }
+
+  const project: (Project & { _id?: string }) | undefined = data.project as
+    | (Project & { _id?: string })
+    | undefined;
+
+  if (!project) {
+    return undefined;
+  }
+
+  const idString: string | undefined =
+    project._id?.toString() || (project.id ? project.id.toString() : undefined);
+
+  return idString ? new ObjectID(idString) : undefined;
+};
+
+/*
+ * Guards a Global SSO / Global OIDC project-attachment: every default team
+ * selected for the attachment MUST belong to the same project the attachment
+ * targets.
+ *
+ * Without this guard, an admin (or a direct API call) could attach a team that
+ * lives in project B to an attachment that targets project A. The SSO/OIDC
+ * login fan-out (see App/FeatureSet/Identity/API/GlobalSSO.ts) provisions a
+ * TeamMember with `projectId = attachment.projectId` but `teamId = team.id`,
+ * and because that path runs with `ignoreHooks: true` no service-level
+ * validation would catch the mismatch — producing a corrupt, cross-project
+ * membership row. This is the server-side backstop for the project-scoped team
+ * picker in the Admin Dashboard.
+ */
+type ValidateGlobalProviderProjectTeamsFunction = (data: {
+  teams: Array<Team> | undefined;
+  projectId: ObjectID | undefined;
+}) => Promise<void>;
+
+const validateGlobalProviderProjectTeams: ValidateGlobalProviderProjectTeamsFunction =
+  async (data: {
+    teams: Array<Team> | undefined;
+    projectId: ObjectID | undefined;
+  }): Promise<void> => {
+    const teams: Array<Team> | undefined = data.teams;
+
+    if (!teams || teams.length === 0) {
+      // No default teams selected: nothing to validate.
+      return;
+    }
+
+    if (!data.projectId) {
+      throw new BadDataException(
+        "A project must be selected before choosing default teams.",
+      );
+    }
+
+    const projectId: string = data.projectId.toString();
+
+    const teamIds: Array<string> = teams
+      .map((team: Team) => {
+        return (
+          team.id?.toString() ||
+          (team as { _id?: string })._id?.toString() ||
+          undefined
+        );
+      })
+      .filter((id: string | undefined): id is string => {
+        return Boolean(id);
+      });
+
+    if (teamIds.length === 0) {
+      return;
+    }
+
+    const foundTeams: Array<Team> = await TeamService.findBy({
+      query: { _id: QueryHelper.any(teamIds) },
+      select: { _id: true, projectId: true },
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: { isRoot: true },
+    });
+
+    if (foundTeams.length !== teamIds.length) {
+      throw new BadDataException(
+        "One or more selected teams could not be found.",
+      );
+    }
+
+    for (const team of foundTeams) {
+      if (team.projectId?.toString() !== projectId) {
+        throw new BadDataException(
+          "All selected teams must belong to the project this provider is attached to.",
+        );
+      }
+    }
+  };
+
+export default validateGlobalProviderProjectTeams;

package/Tests/Server/Middleware/UserAuthorization.test.ts

@@ -1,6 +1,7 @@
 import ProjectMiddleware from "../../../Server/Middleware/ProjectAuthorization";
 import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import AccessTokenService from "../../../Server/Services/AccessTokenService";
+import GlobalConfigService from "../../../Server/Services/GlobalConfigService";
 import ProjectService from "../../../Server/Services/ProjectService";
 import TeamMemberService from "../../../Server/Services/TeamMemberService";
 import UserService from "../../../Server/Services/UserService";
@@ -26,7 +27,6 @@ import {
   UserGlobalAccessPermission,
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
-import Project from "../../../Models/DatabaseModels/Project";
 import {
   describe,
   expect,
@@ -44,6 +44,7 @@ jest.mock("../../../Server/Middleware/ProjectAuthorization");
 jest.mock("../../../Server/Utils/JsonWebToken");
 jest.mock("../../../Server/Services/UserService");
 jest.mock("../../../Server/Services/AccessTokenService");
+jest.mock("../../../Server/Services/GlobalConfigService");
 jest.mock("../../../Server/Utils/Response");
 jest.mock("../../../Server/Services/ProjectService");
 jest.mock("../../../Server/Services/TeamMemberService");
@@ -56,7 +57,6 @@ describe("UserMiddleware", () => {
   const mockedAccessToken: string = ObjectID.generate().toString();
   const projectId: ObjectID = ObjectID.generate();
   const userId: ObjectID = ObjectID.generate();
-  const mockedProject: Project = { _id: projectId.toString() } as Project;
 
   beforeEach(() => {
     jest.clearAllMocks();
@@ -590,15 +590,32 @@ describe("UserMiddleware", () => {
       ProjectService,
       "getRequireSsoForLogin",
     );
+    const spyGetRequireSsoWithSsoProviderId: jest.SpyInstance = getJestSpyOn(
+      ProjectService,
+      "getRequireSsoWithSsoProviderId",
+    );
     const spyDoesSsoTokenForProjectExist: jest.SpyInstance = getJestSpyOn(
       UserMiddleware,
       "doesSsoTokenForProjectExist",
     );
+    const spyGetGlobalRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
+      GlobalConfigService,
+      "getRequireSsoForLogin",
+    );
 
     afterEach(() => {
       jest.clearAllMocks();
     });
 
+    /*
+     * By default no project requires a specific SSO provider (discriminator),
+     * and the instance-wide "Require SSO for Login" flag is off.
+     */
+    beforeEach(() => {
+      spyGetRequireSsoWithSsoProviderId.mockResolvedValue(null);
+      spyGetGlobalRequireSsoForLogin.mockResolvedValue(false);
+    });
+
     test("should throw 'Invalid tenantId' error, when project is not found for the tenantId", async () => {
       spyGetRequireSsoForLogin.mockRejectedValueOnce(
         new BadDataException("Project not found"),
@@ -630,6 +647,7 @@ describe("UserMiddleware", () => {
         req,
         projectId,
         userId,
+        undefined,
       );
     });
 
@@ -688,16 +706,37 @@ describe("UserMiddleware", () => {
       projectId,
     } as UserTenantAccessPermission;
 
-    const spyFindBy: jest.SpyInstance = getJestSpyOn(ProjectService, "findBy");
+    const spyGetProjectRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
+      ProjectService,
+      "getRequireSsoForLogin",
+    );
+    const spyGetRequireSsoWithSsoProviderId: jest.SpyInstance = getJestSpyOn(
+      ProjectService,
+      "getRequireSsoWithSsoProviderId",
+    );
     const spyDoesSsoTokenForProjectExist: jest.SpyInstance = getJestSpyOn(
       UserMiddleware,
       "doesSsoTokenForProjectExist",
     );
+    const spyGetGlobalRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
+      GlobalConfigService,
+      "getRequireSsoForLogin",
+    );
 
     afterEach(() => {
       jest.clearAllMocks();
     });
 
+    /*
+     * By default neither a project's own nor the instance-wide "Require SSO for
+     * Login" flag is on, and no project requires a specific SSO provider.
+     */
+    beforeEach(() => {
+      spyGetProjectRequireSsoForLogin.mockResolvedValue(false);
+      spyGetRequireSsoWithSsoProviderId.mockResolvedValue(null);
+      spyGetGlobalRequireSsoForLogin.mockResolvedValue(false);
+    });
+
     test("should return null, when projectIds length is zero", async () => {
       const result: Dictionary<UserTenantAccessPermission> | null =
         await UserMiddleware.getUserTenantAccessPermissionForMultiTenant(
@@ -707,14 +746,12 @@ describe("UserMiddleware", () => {
         );
 
       expect(result).toBeNull();
-      expect(spyFindBy).not.toBeCalled();
+      expect(spyGetProjectRequireSsoForLogin).not.toBeCalled();
     });
 
     test("should return default tenant access permission, when project for a projectId is found, sso is required for login, but sso token does not exist for that projectId", async () => {
       spyDoesSsoTokenForProjectExist.mockReturnValueOnce(false);
-      spyFindBy.mockResolvedValueOnce([
-        { ...mockedProject, requireSsoForLogin: true },
-      ]);
+      spyGetProjectRequireSsoForLogin.mockResolvedValueOnce(true);
 
       const spyGetDefaultUserTenantAccessPermission: jest.SpyInstance =
         getJestSpyOn(
@@ -736,6 +773,7 @@ describe("UserMiddleware", () => {
         req,
         projectId,
         userId,
+        undefined,
       );
       expect(spyGetDefaultUserTenantAccessPermission).toHaveBeenCalledWith(
         projectId,
@@ -743,8 +781,6 @@ describe("UserMiddleware", () => {
     });
 
     test("should return user tenant access permission, when project for a projectId is found, sso is not required for login and project level permission exist for the projectId", async () => {
-      spyFindBy.mockResolvedValueOnce([mockedProject]);
-
       const spyGetUserTenantAccessPermission: jest.SpyInstance = getJestSpyOn(
         AccessTokenService,
         "getUserTenantAccessPermission",
@@ -768,8 +804,6 @@ describe("UserMiddleware", () => {
     });
 
     test("should return null, when project for a projectId is found, sso is not required for login but project level permission does not exist for the projectId", async () => {
-      spyFindBy.mockResolvedValueOnce([mockedProject]);
-
       const spyGetUserTenantAccessPermission: jest.SpyInstance = getJestSpyOn(
         AccessTokenService,
         "getUserTenantAccessPermission",
@@ -790,7 +824,9 @@ describe("UserMiddleware", () => {
     });
 
     test("should return user tenant access permission, when project for a projectId is not found, but project level permission exist for the projectId", async () => {
-      spyFindBy.mockResolvedValueOnce([]);
+      spyGetProjectRequireSsoForLogin.mockRejectedValueOnce(
+        new BadDataException("Project not found"),
+      );
 
       getJestSpyOn(
         AccessTokenService,
@@ -810,7 +846,9 @@ describe("UserMiddleware", () => {
     });
 
     test("should return null, when project for a projectId is not found, and project level permission does not exist for the projectId", async () => {
-      spyFindBy.mockResolvedValueOnce([]);
+      spyGetProjectRequireSsoForLogin.mockRejectedValueOnce(
+        new BadDataException("Project not found"),
+      );
 
       const spyGetUserTenantAccessPermission: jest.SpyInstance = getJestSpyOn(
         AccessTokenService,