@oneuptime/common 11.3.26 → 11.4.0

package/Tests/Server/Services/OnCallDutyPolicyScheduleLayerUserReorder.test.ts

@@ -0,0 +1,233 @@
+import OnCallDutyPolicyScheduleLayerUserService from "../../../Server/Services/OnCallDutyPolicyScheduleLayerUserService";
+import Model from "../../../Models/DatabaseModels/OnCallDutyPolicyScheduleLayerUser";
+import ObjectID from "../../../Types/ObjectID";
+import logger from "../../../Server/Utils/Logger";
+import { describe, expect, test, afterEach } from "@jest/globals";
+
+/*
+ * OnCallDutyPolicyScheduleLayerUserService.onBeforeUpdate re-sequences the
+ * `order` of the other rows in a schedule layer when a user is dragged to a new
+ * position. Audit finding L3: the "moving down" branch (newOrder > currentOrder)
+ * decremented EVERY row with `order <= newOrder`, including rows ABOVE the moved
+ * user. Dragging a user downward therefore drove the top row's order to 0 (and
+ * negative after repeated down-drags) and opened a gap at 1, breaking the
+ * 1-based contiguous invariant that create-default (count+1) and delete
+ * re-sequencing depend on.
+ *
+ * The fix adds the missing lower bound `resource.order > currentOrder`, so only
+ * rows strictly between the old and new position shift — mirroring the
+ * double-bounded "moving up" branch (`order >= newOrder && order < currentOrder`).
+ *
+ * These tests stub the three persistence helpers onBeforeUpdate calls
+ * (findOneBy -> moved row's current order + layer id; findBy -> every row in the
+ * layer; updateOneBy -> the per-row shift) and CAPTURE each updateOneBy so we can
+ * assert exactly which rows moved and to what order. No Postgres involved.
+ */
+
+const service: any = OnCallDutyPolicyScheduleLayerUserService as any;
+
+// A schedule layer id shared by every row in these single-layer scenarios.
+const LAYER_ID: ObjectID = new ObjectID("layer1");
+
+const USER_A: ObjectID = new ObjectID("A");
+const USER_B: ObjectID = new ObjectID("B");
+const USER_C: ObjectID = new ObjectID("C");
+
+// A captured updateOneBy shift: which row and what order it was set to.
+interface CapturedShift {
+  id: string;
+  order: number;
+}
+
+// Build a fake persisted row for the layer.
+function row(id: ObjectID, order: number): Model {
+  return {
+    _id: id,
+    order,
+    onCallDutyPolicyScheduleLayerId: LAYER_ID,
+  } as unknown as Model;
+}
+
+// Build the UpdateBy passed to onBeforeUpdate for moving `movedId` to `newOrder`.
+function updateBy(movedId: ObjectID, newOrder: number): any {
+  return {
+    data: { order: newOrder },
+    query: { _id: movedId },
+    props: {},
+  } as any;
+}
+
+/*
+ * Stub findOneBy (moved row lookup), findBy (all rows in the layer) and
+ * updateOneBy (record the shift). Returns the array captured shifts are pushed
+ * into so each test can inspect exactly what moved.
+ */
+function stubService(
+  movedRow: Model,
+  layerRows: Array<Model>,
+): Array<CapturedShift> {
+  const captured: Array<CapturedShift> = [];
+
+  jest.spyOn(service, "findOneBy").mockResolvedValue(movedRow as never);
+
+  jest.spyOn(service, "findBy").mockResolvedValue(layerRows as never);
+
+  jest
+    .spyOn(service, "updateOneBy")
+    .mockImplementation((...args: Array<unknown>): Promise<void> => {
+      const updateArg: {
+        query: { _id: ObjectID };
+        data: { order: number };
+      } = args[0] as {
+        query: { _id: ObjectID };
+        data: { order: number };
+      };
+      captured.push({
+        id: updateArg.query._id.toString(),
+        order: updateArg.data.order,
+      });
+      return Promise.resolve();
+    });
+
+  return captured;
+}
+
+describe("OnCallDutyPolicyScheduleLayerUserService.onBeforeUpdate reorder", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * 1. MOVE DOWN B: order 2 -> 3. Only C (3 -> 2) shifts; A is untouched.
+   * -----------------------------------------------------------------------
+   */
+  test("moving B down (2 -> 3) decrements ONLY C and never touches A", async () => {
+    const captured: Array<CapturedShift> = stubService(row(USER_B, 2), [
+      row(USER_A, 1),
+      row(USER_B, 2),
+      row(USER_C, 3),
+    ]);
+
+    await service.onBeforeUpdate(updateBy(USER_B, 3));
+
+    // Exactly one row shifted, and it was C going from 3 down to 2.
+    expect(captured).toHaveLength(1);
+    expect(captured[0]).toEqual({ id: USER_C.toString(), order: 2 });
+
+    // A (the top row) must never be decremented — the regression.
+    const aShifts: Array<CapturedShift> = captured.filter(
+      (c: CapturedShift): boolean => {
+        return c.id === USER_A.toString();
+      },
+    );
+    expect(aShifts).toHaveLength(0);
+
+    /*
+     * After the shift, with the outer update setting B = 3, the resulting layer
+     * is contiguous {A:1, C:2, B:3}.
+     */
+    const finalOrders: Record<string, number> = {
+      [USER_A.toString()]: 1, // untouched
+      [USER_C.toString()]: 2, // shifted
+      [USER_B.toString()]: 3, // set by the outer update
+    };
+    expect(finalOrders[USER_A.toString()]).toBe(1);
+    expect(finalOrders[USER_C.toString()]).toBe(2);
+    expect(finalOrders[USER_B.toString()]).toBe(3);
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * 2. MOVE UP C: order 3 -> 1. A (1 -> 2) and B (2 -> 3) increment; C untouched.
+   * -----------------------------------------------------------------------
+   */
+  test("moving C up (3 -> 1) increments ONLY A and B", async () => {
+    const captured: Array<CapturedShift> = stubService(row(USER_C, 3), [
+      row(USER_A, 1),
+      row(USER_B, 2),
+      row(USER_C, 3),
+    ]);
+
+    await service.onBeforeUpdate(updateBy(USER_C, 1));
+
+    expect(captured).toHaveLength(2);
+
+    const byId: Record<string, number> = {};
+    for (const shift of captured) {
+      byId[shift.id] = shift.order;
+    }
+
+    expect(byId[USER_A.toString()]).toBe(2);
+    expect(byId[USER_B.toString()]).toBe(3);
+    // C itself is not part of the shift loop; the outer update sets it to 1.
+    expect(byId[USER_C.toString()]).toBeUndefined();
+
+    // Contiguous {C:1, A:2, B:3}.
+    const finalOrders: Record<string, number> = {
+      [USER_C.toString()]: 1,
+      [USER_A.toString()]: 2,
+      [USER_B.toString()]: 3,
+    };
+    expect(Object.values(finalOrders).sort()).toEqual([1, 2, 3]);
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * 3. MOVE DOWN A: order 1 -> 3 (dragging the TOP row all the way down).
+   *    Only B (2 -> 1) and C (3 -> 2) decrement; A is not touched by the loop.
+   * -----------------------------------------------------------------------
+   */
+  test("moving the top row A down (1 -> 3) decrements ONLY B and C, no row hits 0", async () => {
+    const captured: Array<CapturedShift> = stubService(row(USER_A, 1), [
+      row(USER_A, 1),
+      row(USER_B, 2),
+      row(USER_C, 3),
+    ]);
+
+    await service.onBeforeUpdate(updateBy(USER_A, 3));
+
+    expect(captured).toHaveLength(2);
+
+    const byId: Record<string, number> = {};
+    for (const shift of captured) {
+      byId[shift.id] = shift.order;
+    }
+
+    expect(byId[USER_B.toString()]).toBe(1);
+    expect(byId[USER_C.toString()]).toBe(2);
+    // A is the moved row itself — the shift loop must not decrement it.
+    expect(byId[USER_A.toString()]).toBeUndefined();
+
+    // Nothing collapsed to 0 or negative.
+    for (const shift of captured) {
+      expect(shift.order).toBeGreaterThan(0);
+    }
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * 4. Regression: in a move-down, NO captured shift may set an order <= 0.
+   *    Before the fix, dragging B down drove A's order to 0. This asserts the
+   *    invariant across the whole move-down code path.
+   * -----------------------------------------------------------------------
+   */
+  test("regression: no move-down shift ever sets order <= 0", async () => {
+    const captured: Array<CapturedShift> = stubService(row(USER_B, 2), [
+      row(USER_A, 1),
+      row(USER_B, 2),
+      row(USER_C, 3),
+    ]);
+
+    await service.onBeforeUpdate(updateBy(USER_B, 3));
+
+    for (const shift of captured) {
+      expect(shift.order).toBeGreaterThan(0);
+    }
+  });
+});
+
+// Keep any incidental logger.error noise out of the test output.
+jest.spyOn(logger, "error").mockImplementation((): void => {
+  return undefined;
+});

package/Tests/Server/Services/OnCallDutyPolicyTimeLogServiceScoping.test.ts

@@ -0,0 +1,242 @@
+import OnCallDutyPolicyTimeLogService from "../../../Server/Services/OnCallDutyPolicyTimeLogService";
+import Model from "../../../Models/DatabaseModels/OnCallDutyPolicyTimeLog";
+import ObjectID from "../../../Types/ObjectID";
+import QueryHelper from "../../../Server/Types/Database/QueryHelper";
+import logger from "../../../Server/Utils/Logger";
+import { describe, expect, test, afterEach } from "@jest/globals";
+
+/*
+ * OnCallDutyPolicyTimeLogService scopes the team/schedule "context" columns of
+ * both its dedup read (startTimeLogForUser) and its close write
+ * (endTimeLogForUser) EXPLICITLY. When a context column is absent the query
+ * must constrain it to IS NULL rather than omit it.
+ *
+ * The old `...(x && { x })` OMITTED an absent column, so the column matched ANY
+ * value. Two bugs followed:
+ *   - audit M3: ending a direct-user assignment (no teamId/scheduleId) matched
+ *     and closed that user's still-open SCHEDULE and TEAM logs too.
+ *   - audit L4: a direct-user start deduped against an already-open
+ *     schedule/team log and never created the direct log.
+ *
+ * These tests mock the inherited DatabaseService persistence helpers
+ * (findOneBy / create / updateBy) so no Postgres is needed, and CAPTURE the
+ * query object each method is called with to assert the exact IS-NULL vs
+ * ObjectID scoping of the teamId and onCallDutyPolicyScheduleId columns.
+ */
+
+/*
+ * The serialized shape of QueryHelper.isNull() — a TypeORM `Raw` FindOperator.
+ * It is stable across calls (the SQL closure is dropped by JSON.stringify), so
+ * structural equality identifies an IS-NULL constraint on a column.
+ */
+const IS_NULL_JSON: string = JSON.stringify(QueryHelper.isNull());
+
+// A distinct value that is NOT an IS-NULL operator, for negative assertions.
+function isIsNull(value: unknown): boolean {
+  return JSON.stringify(value) === IS_NULL_JSON;
+}
+
+// Minimal stand-in for a persisted OnCallDutyPolicyTimeLog row.
+function fakeRow(id: ObjectID): Model {
+  return { id } as unknown as Model;
+}
+
+// Base args shared by every startTimeLogForUser call in these tests.
+function startArgsBase(): {
+  projectId: ObjectID;
+  onCallDutyPolicyId: ObjectID;
+  onCallDutyPolicyEscalationRuleId: ObjectID;
+  userId: ObjectID;
+  startsAt: Date;
+} {
+  return {
+    projectId: new ObjectID("11111111-1111-4111-8111-111111111111"),
+    onCallDutyPolicyId: new ObjectID("22222222-2222-4222-8222-222222222222"),
+    onCallDutyPolicyEscalationRuleId: new ObjectID(
+      "33333333-3333-4333-8333-333333333333",
+    ),
+    userId: new ObjectID("44444444-4444-4444-8444-444444444444"),
+    startsAt: new Date("2026-07-09T00:00:00.000Z"),
+  };
+}
+
+// Capture the `query` object handed to findOneBy on the next call.
+function spyFindOneBy(resolve: Model | null): jest.SpyInstance {
+  return jest
+    .spyOn(OnCallDutyPolicyTimeLogService, "findOneBy")
+    .mockResolvedValue(resolve as never);
+}
+
+// Stub create so startTimeLogForUser can complete when no existing log is found.
+function spyCreate(): jest.SpyInstance {
+  return jest
+    .spyOn(OnCallDutyPolicyTimeLogService, "create")
+    .mockResolvedValue(
+      fakeRow(new ObjectID("99999999-9999-4999-8999-999999999999")) as never,
+    );
+}
+
+// Stub updateBy (returns a row count) for the endTimeLogForUser tests.
+function spyUpdateBy(): jest.SpyInstance {
+  return jest
+    .spyOn(OnCallDutyPolicyTimeLogService, "updateBy")
+    .mockResolvedValue(1 as never);
+}
+
+function queryOf(spy: jest.SpyInstance): Record<string, unknown> {
+  return (spy.mock.calls[0]![0] as { query: Record<string, unknown> }).query;
+}
+
+describe("OnCallDutyPolicyTimeLogService context-column scoping", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * startTimeLogForUser dedup query scoping.
+   * ----------------------------------------------------------------------- *
+   */
+
+  test("startTimeLogForUser with NO teamId/scheduleId scopes both columns to IS NULL", async () => {
+    const findOneBy: jest.SpyInstance = spyFindOneBy(null);
+    const create: jest.SpyInstance = spyCreate();
+
+    await OnCallDutyPolicyTimeLogService.startTimeLogForUser(startArgsBase());
+
+    expect(findOneBy).toHaveBeenCalledTimes(1);
+    const query: Record<string, unknown> = queryOf(findOneBy);
+
+    // A direct-user log must only dedup against other direct logs => IS NULL.
+    expect(isIsNull(query["teamId"])).toBe(true);
+    expect(isIsNull(query["onCallDutyPolicyScheduleId"])).toBe(true);
+    // endsAt IS NULL is always part of the open-log scope.
+    expect(isIsNull(query["endsAt"])).toBe(true);
+
+    // Nothing existed => a fresh log row is created.
+    expect(create).toHaveBeenCalledTimes(1);
+  });
+
+  test("startTimeLogForUser WITH teamId only: teamId matches the passed ObjectID, schedule IS NULL", async () => {
+    const teamId: ObjectID = new ObjectID(
+      "55555555-5555-4555-8555-555555555555",
+    );
+    const findOneBy: jest.SpyInstance = spyFindOneBy(null);
+    spyCreate();
+
+    await OnCallDutyPolicyTimeLogService.startTimeLogForUser({
+      ...startArgsBase(),
+      teamId,
+    });
+
+    const query: Record<string, unknown> = queryOf(findOneBy);
+
+    // teamId is the concrete value passed in (not an IS-NULL operator).
+    expect(isIsNull(query["teamId"])).toBe(false);
+    expect((query["teamId"] as ObjectID).toString()).toBe(teamId.toString());
+    // No schedule context => that column is scoped to IS NULL.
+    expect(isIsNull(query["onCallDutyPolicyScheduleId"])).toBe(true);
+  });
+
+  test("startTimeLogForUser WITH scheduleId only: schedule matches passed ObjectID, teamId IS NULL", async () => {
+    const onCallDutyPolicyScheduleId: ObjectID = new ObjectID(
+      "66666666-6666-4666-8666-666666666666",
+    );
+    const findOneBy: jest.SpyInstance = spyFindOneBy(null);
+    spyCreate();
+
+    await OnCallDutyPolicyTimeLogService.startTimeLogForUser({
+      ...startArgsBase(),
+      onCallDutyPolicyScheduleId,
+    });
+
+    const query: Record<string, unknown> = queryOf(findOneBy);
+
+    // Schedule column is the concrete value passed in.
+    expect(isIsNull(query["onCallDutyPolicyScheduleId"])).toBe(false);
+    expect((query["onCallDutyPolicyScheduleId"] as ObjectID).toString()).toBe(
+      onCallDutyPolicyScheduleId.toString(),
+    );
+    // No team context => that column is scoped to IS NULL.
+    expect(isIsNull(query["teamId"])).toBe(true);
+  });
+
+  test("startTimeLogForUser is idempotent: an existing open log is returned and create is NOT called", async () => {
+    const existingId: ObjectID = new ObjectID(
+      "77777777-7777-4777-8777-777777777777",
+    );
+    const existing: Model = fakeRow(existingId);
+    const findOneBy: jest.SpyInstance = spyFindOneBy(existing);
+    const create: jest.SpyInstance = spyCreate();
+
+    const result: Model =
+      await OnCallDutyPolicyTimeLogService.startTimeLogForUser(startArgsBase());
+
+    expect(findOneBy).toHaveBeenCalledTimes(1);
+    // Returns the already-open log verbatim (audit M1 relies on this).
+    expect(result).toBe(existing);
+    // No duplicate stint is created.
+    expect(create).not.toHaveBeenCalled();
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * endTimeLogForUser close-query scoping.
+   * ----------------------------------------------------------------------- *
+   */
+
+  test("endTimeLogForUser with NO teamId/scheduleId scopes both columns to IS NULL", async () => {
+    const updateBy: jest.SpyInstance = spyUpdateBy();
+
+    await OnCallDutyPolicyTimeLogService.endTimeLogForUser({
+      projectId: new ObjectID("11111111-1111-4111-8111-111111111111"),
+      onCallDutyPolicyId: new ObjectID("22222222-2222-4222-8222-222222222222"),
+      onCallDutyPolicyEscalationRuleId: new ObjectID(
+        "33333333-3333-4333-8333-333333333333",
+      ),
+      userId: new ObjectID("44444444-4444-4444-8444-444444444444"),
+      endsAt: new Date("2026-07-09T01:00:00.000Z"),
+    });
+
+    expect(updateBy).toHaveBeenCalledTimes(1);
+    const query: Record<string, unknown> = queryOf(updateBy);
+
+    // Ending a direct-user stint must NOT close schedule/team logs (audit M3).
+    expect(isIsNull(query["teamId"])).toBe(true);
+    expect(isIsNull(query["onCallDutyPolicyScheduleId"])).toBe(true);
+    expect(isIsNull(query["endsAt"])).toBe(true);
+  });
+
+  test("endTimeLogForUser WITH scheduleId scopes onCallDutyPolicyScheduleId to the passed ObjectID", async () => {
+    const onCallDutyPolicyScheduleId: ObjectID = new ObjectID(
+      "88888888-8888-4888-8888-888888888888",
+    );
+    const updateBy: jest.SpyInstance = spyUpdateBy();
+
+    await OnCallDutyPolicyTimeLogService.endTimeLogForUser({
+      projectId: new ObjectID("11111111-1111-4111-8111-111111111111"),
+      onCallDutyPolicyId: new ObjectID("22222222-2222-4222-8222-222222222222"),
+      onCallDutyPolicyEscalationRuleId: new ObjectID(
+        "33333333-3333-4333-8333-333333333333",
+      ),
+      userId: new ObjectID("44444444-4444-4444-8444-444444444444"),
+      onCallDutyPolicyScheduleId,
+      endsAt: new Date("2026-07-09T01:00:00.000Z"),
+    });
+
+    const query: Record<string, unknown> = queryOf(updateBy);
+
+    // Only THIS schedule's open stint is closed.
+    expect(isIsNull(query["onCallDutyPolicyScheduleId"])).toBe(false);
+    expect((query["onCallDutyPolicyScheduleId"] as ObjectID).toString()).toBe(
+      onCallDutyPolicyScheduleId.toString(),
+    );
+    // No team context supplied => team column stays IS NULL.
+    expect(isIsNull(query["teamId"])).toBe(true);
+  });
+});
+
+// Silence any incidental logger.error noise from the service under test.
+jest.spyOn(logger, "error").mockImplementation((): void => {
+  return undefined;
+});

package/Tests/Server/Services/OnCallDutyPolicyUserOverrideEdit.test.ts

@@ -0,0 +1,198 @@
+import OnCallDutyPolicyUserOverrideService from "../../../Server/Services/OnCallDutyPolicyUserOverrideService";
+import OnCallDutyPolicyScheduleService from "../../../Server/Services/OnCallDutyPolicyScheduleService";
+import ObjectID from "../../../Types/ObjectID";
+import logger from "../../../Server/Utils/Logger";
+import { describe, expect, test, afterEach } from "@jest/globals";
+
+/*
+ * Audit finding M2: an override edit that changes overrideUserId from A to A2
+ * used to refresh only A2's schedules. Schedules that contained A (but NOT A2)
+ * therefore kept showing the substitute forever — until the next natural
+ * handoff — because refreshRostersForUserInProject selects schedules by the
+ * NEW user only.
+ *
+ * The fix captures each affected override's PRE-update {projectId,
+ * overrideUserId} in onBeforeUpdate (carryForward), and onUpdateSuccess then
+ * refreshes rosters for BOTH the OLD users (from carryForward) and the NEW
+ * users (looked up post-update by id), deduped by "projectId:overrideUserId".
+ *
+ * The private refreshRostersForOverrideUser lazy-requires
+ * OnCallDutyPolicyScheduleService and calls its
+ * refreshRostersForUserInProject({projectId, userId}). Because the test imports
+ * the very same singleton the lazy require resolves to, spying that public
+ * method observes exactly which {projectId, userId} pairs are refreshed.
+ *
+ * The hooks are protected, so they are invoked via (service as any).
+ */
+
+// Fixed ids so assertions read clearly. ObjectID accepts arbitrary strings.
+const P1: ObjectID = new ObjectID("p1");
+const USER_A: ObjectID = new ObjectID("A");
+const USER_A2: ObjectID = new ObjectID("A2");
+const OV1: ObjectID = new ObjectID("ov1");
+
+// Build a minimal root UpdateBy the hooks accept.
+function fakeUpdateBy(): any {
+  return {
+    query: { _id: OV1 },
+    data: {},
+    props: { isRoot: true },
+  };
+}
+
+// The set of userId strings refreshRostersForUserInProject was called with.
+function refreshedUserIds(spy: jest.SpyInstance): Array<string> {
+  return spy.mock.calls.map((call: Array<unknown>): string => {
+    const arg: { projectId: ObjectID; userId: ObjectID } = call[0] as {
+      projectId: ObjectID;
+      userId: ObjectID;
+    };
+    return arg.userId.toString();
+  });
+}
+
+describe("OnCallDutyPolicyUserOverrideService update-roster refresh (audit M2)", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  // Keep best-effort logger.error noise out of the test output.
+  function silenceLoggerError(): void {
+    jest.spyOn(logger, "error").mockImplementation((): void => {
+      return undefined;
+    });
+  }
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * (1) onBeforeUpdate captures the OLD override user into carryForward.
+   * ----------------------------------------------------------------------- *
+   */
+  test("onBeforeUpdate captures the pre-update {projectId, overrideUserId} into carryForward", async () => {
+    silenceLoggerError();
+
+    // findBy returns the row(s) that match the update query, PRE-update.
+    const findBy: jest.SpyInstance = jest
+      .spyOn(OnCallDutyPolicyUserOverrideService, "findBy")
+      .mockResolvedValue([{ projectId: P1, overrideUserId: USER_A }] as any);
+
+    const onUpdate: any = await (
+      OnCallDutyPolicyUserOverrideService as any
+    ).onBeforeUpdate(fakeUpdateBy());
+
+    expect(findBy).toHaveBeenCalledTimes(1);
+
+    const carryForward: Array<{
+      projectId: ObjectID;
+      overrideUserId: ObjectID;
+    }> = onUpdate.carryForward;
+
+    expect(Array.isArray(carryForward)).toBe(true);
+    expect(carryForward).toHaveLength(1);
+    expect(carryForward[0]!.projectId.toString()).toBe(P1.toString());
+    expect(carryForward[0]!.overrideUserId.toString()).toBe(USER_A.toString());
+
+    // The original updateBy is threaded through unchanged.
+    expect(onUpdate.updateBy.query["_id"].toString()).toBe(OV1.toString());
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * (2) onUpdateSuccess refreshes BOTH the old (A) and the new (A2) users.
+   * ----------------------------------------------------------------------- *
+   */
+  test("onUpdateSuccess refreshes rosters for BOTH the old (A) and new (A2) override users", async () => {
+    silenceLoggerError();
+
+    // The post-update row for OV1 now points at the NEW user A2.
+    jest
+      .spyOn(OnCallDutyPolicyUserOverrideService, "findOneById")
+      .mockResolvedValue({ projectId: P1, overrideUserId: USER_A2 } as any);
+
+    const refresh: jest.SpyInstance = jest
+      .spyOn(OnCallDutyPolicyScheduleService, "refreshRostersForUserInProject")
+      .mockResolvedValue(undefined);
+
+    const onUpdate: any = {
+      updateBy: fakeUpdateBy(),
+      // OLD user captured by onBeforeUpdate.
+      carryForward: [{ projectId: P1, overrideUserId: USER_A }],
+    };
+
+    await (OnCallDutyPolicyUserOverrideService as any).onUpdateSuccess(
+      onUpdate,
+      [OV1],
+    );
+
+    const userIds: Array<string> = refreshedUserIds(refresh);
+
+    // Both the vacated user A and the substitute A2 have their rosters recomputed.
+    expect(userIds).toContain(USER_A.toString());
+    expect(userIds).toContain(USER_A2.toString());
+    expect(refresh).toHaveBeenCalledTimes(2);
+
+    // Every refresh is scoped to the correct project.
+    for (const call of refresh.mock.calls) {
+      const arg: { projectId: ObjectID; userId: ObjectID } = call[0] as {
+        projectId: ObjectID;
+        userId: ObjectID;
+      };
+      expect(arg.projectId.toString()).toBe(P1.toString());
+    }
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * (3) DEDUP: an unchanged override user (A -> A) is refreshed exactly once.
+   * ----------------------------------------------------------------------- *
+   */
+  test("onUpdateSuccess dedupes: when old == new (A -> A) the roster refresh runs exactly ONCE", async () => {
+    silenceLoggerError();
+
+    // Post-update row still points at A (only e.g. the times changed).
+    jest
+      .spyOn(OnCallDutyPolicyUserOverrideService, "findOneById")
+      .mockResolvedValue({ projectId: P1, overrideUserId: USER_A } as any);
+
+    const refresh: jest.SpyInstance = jest
+      .spyOn(OnCallDutyPolicyScheduleService, "refreshRostersForUserInProject")
+      .mockResolvedValue(undefined);
+
+    const onUpdate: any = {
+      updateBy: fakeUpdateBy(),
+      carryForward: [{ projectId: P1, overrideUserId: USER_A }],
+    };
+
+    await (OnCallDutyPolicyUserOverrideService as any).onUpdateSuccess(
+      onUpdate,
+      [OV1],
+    );
+
+    // Same {p1, A} from both the old and new side: refreshed a single time.
+    expect(refresh).toHaveBeenCalledTimes(1);
+    expect(refreshedUserIds(refresh)).toEqual([USER_A.toString()]);
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * (4) onBeforeUpdate is best-effort: a findBy failure yields empty
+   *     carryForward and does NOT reject the update path.
+   * ----------------------------------------------------------------------- *
+   */
+  test("onBeforeUpdate is resilient: if findBy throws, it returns an empty carryForward and does not reject", async () => {
+    silenceLoggerError();
+
+    jest
+      .spyOn(OnCallDutyPolicyUserOverrideService, "findBy")
+      .mockRejectedValue(new Error("db unavailable"));
+
+    const onUpdate: any = await (
+      OnCallDutyPolicyUserOverrideService as any
+    ).onBeforeUpdate(fakeUpdateBy());
+
+    expect(Array.isArray(onUpdate.carryForward)).toBe(true);
+    expect(onUpdate.carryForward).toHaveLength(0);
+    // The updateBy is still threaded through so the CRUD update proceeds.
+    expect(onUpdate.updateBy).toBeTruthy();
+  });
+});