@oneuptime/common 11.5.12 → 11.6.0

package/Tests/Server/Utils/AI/Insights/InsightTriageRunner.test.ts

@@ -7,12 +7,18 @@ import InstrumentationTaskTrigger from "../../../../../Server/Utils/AI/SRE/Instr
 import { ConfidenceSignal } from "../../../../../Server/Utils/AI/SRE/ConfidenceSignal";
 import { ObservabilityAssistantResult } from "../../../../../Server/Utils/AI/Chat/ObservabilityAssistant";
 import AIInsightService from "../../../../../Server/Services/AIInsightService";
+import ProjectService from "../../../../../Server/Services/ProjectService";
+import TelemetryExceptionService from "../../../../../Server/Services/TelemetryExceptionService";
 import IncidentFeedService from "../../../../../Server/Services/IncidentFeedService";
 import AlertFeedService from "../../../../../Server/Services/AlertFeedService";
 import { AI_INSIGHT_TRIAGE_FEATURE } from "../../../../../Server/Services/AIService";
+import InsightFixRouting from "../../../../../Server/Utils/AI/SRE/Insights/FixRouting";
 import AIInsight from "../../../../../Models/DatabaseModels/AIInsight";
+import Project from "../../../../../Models/DatabaseModels/Project";
 import AIInsightType from "../../../../../Types/AI/AIInsightType";
 import AIInsightSeverity from "../../../../../Types/AI/AIInsightSeverity";
+import AIInsightStatus from "../../../../../Types/AI/AIInsightStatus";
+import ExceptionAIClassification from "../../../../../Types/AI/ExceptionAIClassification";
 import ObjectID from "../../../../../Types/ObjectID";
 import { describe, expect, test, afterEach } from "@jest/globals";
 
@@ -34,9 +40,10 @@ const aiRunId: ObjectID = ObjectID.generate();
 const projectId: ObjectID = ObjectID.generate();
 const sentinelInsightId: ObjectID = ObjectID.generate();
 
-function makeInsight(): AIInsight {
+function makeInsight(overrides: Partial<AIInsight> = {}): AIInsight {
   return {
     id: sentinelInsightId,
+    projectId,
     insightType: AIInsightType.ExceptionSpike,
     severity: AIInsightSeverity.High,
     title: "Spike: NullPointerException in checkout",
@@ -50,9 +57,34 @@ function makeInsight(): AIInsight {
         spikeMultiplier: 60,
       },
     },
+    ...overrides,
   } as unknown as AIInsight;
 }
 
+/*
+ * Harness for the verdict-driven follow-through: the engine is mocked to
+ * immediately drive postAnalysis with the given analysis text, exactly the
+ * way the real engine hands over its result.
+ */
+function driveTriageWithAnalysis(analysisMarkdown: string): void {
+  jest
+    .spyOn(AIInvestigationEngine, "executeRun")
+    .mockImplementation(
+      async (data: {
+        aiRunId: ObjectID;
+        projectId: ObjectID;
+        attemptCount: number;
+        request: InvestigationRequest;
+      }): Promise<void> => {
+        await data.request.postAnalysis({
+          analysisMarkdown,
+          confidence: makeConfidence(),
+          result: {} as unknown as ObservabilityAssistantResult,
+        });
+      },
+    );
+}
+
 function makeConfidence(): ConfidenceSignal {
   return { confident: true, source: "classification" };
 }
@@ -218,4 +250,248 @@ describe("InsightTriageRunner.executeTriage", () => {
     expect(alertFeed).not.toHaveBeenCalled();
     expect(instrumentationTrigger).not.toHaveBeenCalled();
   });
+
+  test("a code-fault verdict stamps the exception, routes the fix post-triage, and flips the insight to FixOpened", async () => {
+    const telemetryExceptionId: ObjectID = ObjectID.generate();
+    jest
+      .spyOn(AIInsightService, "findOneById")
+      .mockResolvedValue(makeInsight({ telemetryExceptionId }));
+    const persistInsight: jest.SpyInstance = jest
+      .spyOn(AIInsightService, "updateOneById")
+      .mockResolvedValue(undefined);
+    const flipStatus: jest.SpyInstance = jest
+      .spyOn(AIInsightService, "updateOneBy")
+      .mockResolvedValue(undefined as never);
+    const stampException: jest.SpyInstance = jest
+      .spyOn(TelemetryExceptionService, "updateOneById")
+      .mockResolvedValue(undefined as never);
+    jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
+      id: projectId,
+      enableAi: true,
+      enableInsightFixTasks: true,
+      autoArchiveNonActionableExceptions: false,
+    } as unknown as Project);
+    const fixAiRunId: ObjectID = ObjectID.generate();
+    const routeFix: jest.SpyInstance = jest
+      .spyOn(InsightFixRouting, "routeInsightFix")
+      .mockResolvedValue({ fixAiRunId });
+
+    driveTriageWithAnalysis(
+      "Root cause: null deref in checkout.\n\nClassification: code-fault",
+    );
+
+    await InsightTriageRunner.executeTriage({
+      aiRunId,
+      projectId,
+      sentinelInsightId,
+      attemptCount: 1,
+    });
+
+    // The verdict lands on the insight row alongside the summary.
+    expect(persistInsight).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: sentinelInsightId,
+        data: expect.objectContaining({
+          classification: ExceptionAIClassification.CodeFault,
+        }),
+      }),
+    );
+    // ...and on the exception group row.
+    expect(stampException).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: telemetryExceptionId,
+        data: expect.objectContaining({
+          aiClassification: ExceptionAIClassification.CodeFault,
+        }),
+      }),
+    );
+    /*
+     * The fix decision happens HERE, post-verdict — and flips the status
+     * CONDITIONALLY: only a still-ActionRequired insight becomes FixOpened.
+     */
+    expect(routeFix).toHaveBeenCalledTimes(1);
+    expect(flipStatus).toHaveBeenCalledWith(
+      expect.objectContaining({
+        query: expect.objectContaining({
+          status: AIInsightStatus.ActionRequired,
+        }),
+        data: expect.objectContaining({
+          status: AIInsightStatus.FixOpened,
+          fixAiRunId,
+        }),
+      }),
+    );
+  });
+
+  test("a human Dismissed/Resolved during triage blocks all automation — no fix, no archive, terminal status untouched", async () => {
+    const telemetryExceptionId: ObjectID = ObjectID.generate();
+
+    /*
+     * First read (context build) returns the snapshot; the SECOND read is
+     * actOnClassification's status re-check — the human dismissed the
+     * insight while the triage run executed.
+     */
+    jest
+      .spyOn(AIInsightService, "findOneById")
+      .mockResolvedValueOnce(makeInsight({ telemetryExceptionId }))
+      .mockResolvedValue(
+        makeInsight({
+          telemetryExceptionId,
+          status: AIInsightStatus.Dismissed,
+        }),
+      );
+    const persistInsight: jest.SpyInstance = jest
+      .spyOn(AIInsightService, "updateOneById")
+      .mockResolvedValue(undefined);
+    const flipStatus: jest.SpyInstance = jest
+      .spyOn(AIInsightService, "updateOneBy")
+      .mockResolvedValue(undefined as never);
+    const exceptionWrites: jest.SpyInstance = jest
+      .spyOn(TelemetryExceptionService, "updateOneById")
+      .mockResolvedValue(undefined as never);
+    const routeFix: jest.SpyInstance = jest.spyOn(
+      InsightFixRouting,
+      "routeInsightFix",
+    );
+
+    driveTriageWithAnalysis(
+      "A clear null deref.\n\nClassification: code-fault",
+    );
+
+    await InsightTriageRunner.executeTriage({
+      aiRunId,
+      projectId,
+      sentinelInsightId,
+      attemptCount: 1,
+    });
+
+    // The verdict still lands (summary + classification are metadata)...
+    expect(persistInsight).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          classification: ExceptionAIClassification.CodeFault,
+        }),
+      }),
+    );
+    // ...but no automation fires, and the terminal status is never touched.
+    expect(routeFix).not.toHaveBeenCalled();
+    expect(flipStatus).not.toHaveBeenCalled();
+    expect(exceptionWrites).toHaveBeenCalledTimes(1); // classification stamp only
+    expect(exceptionWrites).not.toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ isArchived: true }),
+      }),
+    );
+  });
+
+  test("a user-error verdict NEVER routes a fix", async () => {
+    const telemetryExceptionId: ObjectID = ObjectID.generate();
+    jest
+      .spyOn(AIInsightService, "findOneById")
+      .mockResolvedValue(makeInsight({ telemetryExceptionId }));
+    jest.spyOn(AIInsightService, "updateOneById").mockResolvedValue(undefined);
+    const exceptionWrites: jest.SpyInstance = jest
+      .spyOn(TelemetryExceptionService, "updateOneById")
+      .mockResolvedValue(undefined as never);
+    jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
+      id: projectId,
+      enableAi: true,
+      enableInsightFixTasks: true,
+      autoArchiveNonActionableExceptions: false,
+    } as unknown as Project);
+    const routeFix: jest.SpyInstance = jest.spyOn(
+      InsightFixRouting,
+      "routeInsightFix",
+    );
+
+    driveTriageWithAnalysis(
+      "The uuid in the URL was garbage user input.\n\nClassification: user-error",
+    );
+
+    await InsightTriageRunner.executeTriage({
+      aiRunId,
+      projectId,
+      sentinelInsightId,
+      attemptCount: 1,
+    });
+
+    expect(routeFix).not.toHaveBeenCalled();
+    // The verdict still lands on the exception; no archive (not a denial).
+    expect(exceptionWrites).toHaveBeenCalledTimes(1);
+    expect(exceptionWrites).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          aiClassification: ExceptionAIClassification.UserError,
+        }),
+      }),
+    );
+  });
+
+  test("an expected-denial verdict auto-archives the exception ONLY when the project opted in", async () => {
+    const telemetryExceptionId: ObjectID = ObjectID.generate();
+    jest
+      .spyOn(AIInsightService, "findOneById")
+      .mockResolvedValue(makeInsight({ telemetryExceptionId }));
+    jest.spyOn(AIInsightService, "updateOneById").mockResolvedValue(undefined);
+    const exceptionWrites: jest.SpyInstance = jest
+      .spyOn(TelemetryExceptionService, "updateOneById")
+      .mockResolvedValue(undefined as never);
+    const routeFix: jest.SpyInstance = jest.spyOn(
+      InsightFixRouting,
+      "routeInsightFix",
+    );
+
+    // Opted IN: the group gets archived.
+    jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
+      id: projectId,
+      enableAi: true,
+      enableInsightFixTasks: true,
+      autoArchiveNonActionableExceptions: true,
+    } as unknown as Project);
+
+    driveTriageWithAnalysis(
+      "This is the paywall doing its job.\n\nClassification: expected-denial",
+    );
+
+    await InsightTriageRunner.executeTriage({
+      aiRunId,
+      projectId,
+      sentinelInsightId,
+      attemptCount: 1,
+    });
+
+    expect(routeFix).not.toHaveBeenCalled();
+    expect(exceptionWrites).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: telemetryExceptionId,
+        data: expect.objectContaining({
+          isArchived: true,
+          markedAsArchivedAt: expect.any(Date),
+        }),
+      }),
+    );
+
+    // Opted OUT: verdict stamp only, no archive write.
+    exceptionWrites.mockClear();
+    jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
+      id: projectId,
+      enableAi: true,
+      enableInsightFixTasks: true,
+      autoArchiveNonActionableExceptions: false,
+    } as unknown as Project);
+
+    await InsightTriageRunner.executeTriage({
+      aiRunId,
+      projectId,
+      sentinelInsightId,
+      attemptCount: 1,
+    });
+
+    expect(exceptionWrites).toHaveBeenCalledTimes(1);
+    expect(exceptionWrites).not.toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ isArchived: true }),
+      }),
+    );
+  });
 });

package/Tests/Server/Utils/Attribution.test.ts

@@ -0,0 +1,203 @@
+import Attribution from "../../../Server/Utils/Attribution";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, test } from "@jest/globals";
+
+describe("Attribution", () => {
+  describe("sanitizeClickIds", () => {
+    test("keeps every supported ad-platform click identifier", () => {
+      const clickIds: JSONObject = {
+        gclid: "google-click",
+        wbraid: "google-web-to-app",
+        gbraid: "google-app-to-web",
+        fbclid: "meta-click",
+        msclkid: "microsoft-click",
+        li_fat_id: "linkedin-click",
+        twclid: "x-click",
+        rdt_cid: "reddit-click",
+      };
+
+      expect(Attribution.sanitizeClickIds(clickIds)).toEqual(clickIds);
+    });
+
+    test("drops keys that are not explicitly allowlisted", () => {
+      expect(
+        Attribution.sanitizeClickIds({
+          gclid: "valid",
+          attackerControlledKey: "must-not-persist",
+          __proto__: "must-not-persist",
+        }),
+      ).toEqual({ gclid: "valid" });
+    });
+
+    test.each([null, undefined, "gclid=x", 42, true, ["gclid"]])(
+      "rejects a non-object value: %p",
+      (value: unknown) => {
+        expect(Attribution.sanitizeClickIds(value as never)).toBeUndefined();
+      },
+    );
+
+    test("drops empty, boolean and object click-id values", () => {
+      expect(
+        Attribution.sanitizeClickIds({
+          gclid: "",
+          fbclid: false,
+          msclkid: { nested: "value" },
+        }),
+      ).toBeUndefined();
+    });
+
+    test("normalizes numeric identifiers to strings", () => {
+      expect(
+        Attribution.sanitizeClickIds({
+          gclid: 12345,
+          msclkid: 67890,
+        }),
+      ).toEqual({
+        gclid: "12345",
+        msclkid: "67890",
+      });
+    });
+
+    test("caps each identifier at 500 characters", () => {
+      const result: JSONObject | undefined = Attribution.sanitizeClickIds({
+        gclid: "g".repeat(600),
+        fbclid: "f".repeat(501),
+      });
+
+      expect(result?.["gclid"]).toBe("g".repeat(500));
+      expect(result?.["fbclid"]).toBe("f".repeat(500));
+    });
+
+    test("returns a fresh object instead of retaining the untrusted input", () => {
+      const input: JSONObject = { gclid: "original" };
+      const result: JSONObject | undefined =
+        Attribution.sanitizeClickIds(input);
+
+      input["gclid"] = "mutated";
+
+      expect(result).toEqual({ gclid: "original" });
+      expect(result).not.toBe(input);
+    });
+  });
+
+  describe("sanitizeFirstTouchAttribution", () => {
+    test("keeps the complete supported first-touch payload", () => {
+      const firstTouch: JSONObject = {
+        utmSource: "google",
+        utmMedium: "cpc",
+        utmCampaign: "pagerduty-alternative",
+        utmTerm: "pagerduty alternative",
+        utmContent: "comparison-ad-a",
+        landingUrl: "https://oneuptime.com/compare/pagerduty?gclid=abc",
+        referrer: "https://google.com/",
+        timestamp: "2026-07-22T10:00:00.000Z",
+        clickIds: {
+          gclid: "abc",
+          msclkid: "def",
+        },
+      };
+
+      expect(Attribution.sanitizeFirstTouchAttribution(firstTouch)).toEqual(
+        firstTouch,
+      );
+    });
+
+    test("drops unknown top-level and nested click-id keys", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          utmSource: "google",
+          arbitrary: "do-not-store",
+          clickIds: {
+            gclid: "valid",
+            arbitraryClickId: "do-not-store",
+          },
+        }),
+      ).toEqual({
+        utmSource: "google",
+        clickIds: { gclid: "valid" },
+      });
+    });
+
+    test("keeps valid first-touch fields when clickIds is malformed", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          utmSource: "newsletter",
+          clickIds: ["not", "an", "object"],
+        }),
+      ).toEqual({ utmSource: "newsletter" });
+    });
+
+    test("keeps valid click IDs when no UTM values exist", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          clickIds: { gclid: "auto-tagged-click" },
+        }),
+      ).toEqual({
+        clickIds: { gclid: "auto-tagged-click" },
+      });
+    });
+
+    test("caps all first-touch strings and nested click IDs", () => {
+      const result: JSONObject | undefined =
+        Attribution.sanitizeFirstTouchAttribution({
+          utmCampaign: "c".repeat(700),
+          landingUrl: "l".repeat(700),
+          clickIds: { gclid: "g".repeat(700) },
+        });
+
+      expect(result?.["utmCampaign"]).toBe("c".repeat(500));
+      expect(result?.["landingUrl"]).toBe("l".repeat(500));
+      expect((result?.["clickIds"] as JSONObject)?.["gclid"]).toBe(
+        "g".repeat(500),
+      );
+    });
+
+    test("normalizes numeric scalar values", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          utmCampaign: 2026,
+          timestamp: 123456,
+        }),
+      ).toEqual({
+        utmCampaign: "2026",
+        timestamp: "123456",
+      });
+    });
+
+    test.each([null, undefined, "utm_source=google", 42, true, []])(
+      "rejects a non-object first-touch value: %p",
+      (value: unknown) => {
+        expect(
+          Attribution.sanitizeFirstTouchAttribution(value as never),
+        ).toBeUndefined();
+      },
+    );
+
+    test("returns undefined when every supplied field is invalid", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          unsupported: "value",
+          clickIds: { unsupported: "value" },
+        }),
+      ).toBeUndefined();
+    });
+
+    test("does not retain mutable nested input objects", () => {
+      const clickIds: JSONObject = { gclid: "original" };
+      const input: JSONObject = {
+        utmSource: "google",
+        clickIds,
+      };
+      const result: JSONObject | undefined =
+        Attribution.sanitizeFirstTouchAttribution(input);
+
+      clickIds["gclid"] = "mutated";
+      input["utmSource"] = "mutated";
+
+      expect(result).toEqual({
+        utmSource: "google",
+        clickIds: { gclid: "original" },
+      });
+    });
+  });
+});

package/Tests/Server/Utils/ExceptionSanitizer.test.ts

@@ -0,0 +1,70 @@
+import {
+  normalizeExceptionText,
+  sanitizeExceptionMessage,
+  sanitizeStackTrace,
+} from "../../../Server/Utils/Telemetry/ExceptionSanitizer";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The sanitizer feeds two very different consumers:
+ *
+ * - normalizeExceptionText is the FINGERPRINT normalizer (moved here from
+ *   App's ExceptionUtil) — its replacement behavior must stay stable or
+ *   every existing exception group re-fingerprints.
+ * - sanitizeExceptionMessage / sanitizeStackTrace guard the surfaces that
+ *   leave the platform: LLM prompts, PR titles/bodies, commit messages.
+ */
+describe("normalizeExceptionText", () => {
+  test("replaces dynamic tokens with placeholders", () => {
+    expect(
+      normalizeExceptionText(
+        'invalid input syntax for type uuid: "550e8400-e29b-41d4-a716-446655440000"',
+      ),
+    ).toContain("<UUID>");
+
+    expect(
+      normalizeExceptionText("failed to email john.doe@example.com"),
+    ).toContain("<EMAIL>");
+
+    expect(normalizeExceptionText("connect ETIMEDOUT 10.2.3.4:5432")).toContain(
+      "<IP>",
+    );
+  });
+
+  test("keeps the static structure of the message", () => {
+    const normalized: string = normalizeExceptionText(
+      "Domain lookup failed for id=12345678",
+    );
+
+    expect(normalized).toContain("Domain lookup failed");
+    expect(normalized).not.toContain("12345678");
+  });
+
+  test("empty input stays empty", () => {
+    expect(normalizeExceptionText("")).toBe("");
+  });
+});
+
+describe("sanitizeExceptionMessage", () => {
+  test("strips interpolated user data and secrets", () => {
+    const sanitized: string = sanitizeExceptionMessage(
+      "Login failed for jane@customer.com with token ghp_0123456789abcdefghijklmnopqrstuvwxyz1234",
+    );
+
+    expect(sanitized).not.toContain("jane@customer.com");
+    expect(sanitized).not.toContain("ghp_0123456789");
+    expect(sanitized).toContain("Login failed");
+  });
+});
+
+describe("sanitizeStackTrace", () => {
+  test("preserves file:line frames while stripping PII", () => {
+    const sanitized: string = sanitizeStackTrace(
+      "Error: boom for user jane@customer.com\n    at charge (/app/src/billing/charge.ts:12:5)",
+    );
+
+    // The code agent needs the frame intact to locate the defect.
+    expect(sanitized).toContain("/app/src/billing/charge.ts:12:5");
+    expect(sanitized).not.toContain("jane@customer.com");
+  });
+});

package/Tests/Server/Utils/InsightTriageClassification.test.ts

@@ -0,0 +1,57 @@
+import InsightTriageRunner from "../../../Server/Utils/AI/SRE/Insights/InsightTriageRunner";
+import ExceptionAIClassification from "../../../Types/AI/ExceptionAIClassification";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The triage verdict gates the automatic fix lane, so the parser must fail
+ * CLOSED: anything unparseable reads as Unknown, and Unknown never routes
+ * a fix pull request.
+ */
+describe("InsightTriageRunner.parseClassification", () => {
+  test("parses the mandatory trailing verdict line", () => {
+    expect(
+      InsightTriageRunner.parseClassification(
+        "Root cause: bad uuid in URL.\n\nClassification: user-error",
+      ),
+    ).toBe(ExceptionAIClassification.UserError);
+  });
+
+  test("tolerates markdown emphasis and mixed case", () => {
+    expect(
+      InsightTriageRunner.parseClassification(
+        "analysis...\n**Classification:** code-fault",
+      ),
+    ).toBe(ExceptionAIClassification.CodeFault);
+
+    expect(
+      InsightTriageRunner.parseClassification(
+        "analysis...\nCLASSIFICATION: expected-denial",
+      ),
+    ).toBe(ExceptionAIClassification.ExpectedDenial);
+  });
+
+  test("the LAST verdict line wins when the taxonomy is discussed earlier", () => {
+    const analysis: string = [
+      "The options were:",
+      "Classification: code-fault",
+      "...but the paywall check fired intentionally.",
+      "Classification: expected-denial",
+    ].join("\n");
+
+    expect(InsightTriageRunner.parseClassification(analysis)).toBe(
+      ExceptionAIClassification.ExpectedDenial,
+    );
+  });
+
+  test("fails CLOSED: missing, malformed, or empty input reads as unknown", () => {
+    expect(InsightTriageRunner.parseClassification("no verdict here")).toBe(
+      ExceptionAIClassification.Unknown,
+    );
+    expect(
+      InsightTriageRunner.parseClassification("Classification: maybe-a-bug"),
+    ).toBe(ExceptionAIClassification.Unknown);
+    expect(InsightTriageRunner.parseClassification("")).toBe(
+      ExceptionAIClassification.Unknown,
+    );
+  });
+});