@oneuptime/common 11.5.13 → 11.6.0

package/Tests/Server/Services/DatabaseServiceSanitizeUpdateData.test.ts

@@ -0,0 +1,232 @@
+import NetworkDeviceDiscoveryScanService from "../../../Server/Services/NetworkDeviceDiscoveryScanService";
+import ModelPermission from "../../../Server/Types/Database/Permissions/Index";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import NetworkDeviceDiscoveryScan from "../../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Probe from "../../../Models/DatabaseModels/Probe";
+import ObjectID from "../../../Types/ObjectID";
+import OneUptimeDate from "../../../Types/Date";
+import { JSONObject } from "../../../Types/JSON";
+import Select from "../../../Server/Types/Database/Select";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+type ScanUpdateData = UpdateBy<NetworkDeviceDiscoveryScan>["data"];
+
+/*
+ * Regression tests for the bug that left every SNMP discovery scan stuck in
+ * "Pending": update `data` passed as a full model instance carries the
+ * non-column own properties of DatabaseBaseModel (column initializers plus
+ * `isPermissionIf = {}`). _updateBy used to turn every data key into a select
+ * column for its internal find, and the unknown `isPermissionIf` column made
+ * that find throw `TableColumnMetadata not found for isPermissionIf column`,
+ * failing the whole update — so the probe-ingest list endpoint 400'd before
+ * it could claim a scan.
+ *
+ * sanitizeUpdateData is the fix: model instances are stripped down to their
+ * set table columns before the update pipeline runs.
+ */
+
+describe("DatabaseService.sanitizeUpdateData — model instances become plain column data", () => {
+  test("a fresh model instance really does carry non-column own properties (the trap this guards against)", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+
+    /*
+     * If this stops holding, the base model changed shape and these tests
+     * (and sanitizeUpdateData itself) should be revisited.
+     */
+    expect(Object.keys(scan)).toContain("isPermissionIf");
+  });
+
+  test("keeps only the columns that were actually set", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    scan.status = "In Progress";
+    scan.startedAt = OneUptimeDate.getCurrentDate();
+
+    const data: ScanUpdateData = NetworkDeviceDiscoveryScanService[
+      "sanitizeUpdateData"
+    ](scan as unknown as ScanUpdateData);
+
+    expect(Object.keys(data as JSONObject).sort()).toEqual([
+      "startedAt",
+      "status",
+    ]);
+    expect((data as JSONObject)["status"]).toBe("In Progress");
+    expect((data as JSONObject)["startedAt"]).toBeInstanceOf(Date);
+  });
+
+  test("the result is a plain object, not a model instance", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    scan.status = "Completed";
+
+    const data: ScanUpdateData = NetworkDeviceDiscoveryScanService[
+      "sanitizeUpdateData"
+    ](scan as unknown as ScanUpdateData);
+
+    expect(data).not.toBeInstanceOf(DatabaseBaseModel);
+    expect(Object.getPrototypeOf(data)).toBe(Object.prototype);
+  });
+
+  test("drops isPermissionIf and every other non-column own property", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    scan.status = "Completed";
+
+    const data: ScanUpdateData = NetworkDeviceDiscoveryScanService[
+      "sanitizeUpdateData"
+    ](scan as unknown as ScanUpdateData);
+
+    expect(Object.keys(data as JSONObject)).not.toContain("isPermissionIf");
+  });
+
+  test("drops columns left undefined so they cannot become writes", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    scan.status = "Failed";
+    // cidr, snmpVersion, statusMessage etc. stay undefined.
+
+    const data: ScanUpdateData = NetworkDeviceDiscoveryScanService[
+      "sanitizeUpdateData"
+    ](scan as unknown as ScanUpdateData);
+
+    expect(Object.keys(data as JSONObject)).toEqual(["status"]);
+  });
+
+  test("preserves explicit null so columns can still be cleared", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    scan.status = "Pending";
+    (scan as any).statusMessage = null;
+    (scan as any).nextScanAt = null;
+
+    const data: ScanUpdateData = NetworkDeviceDiscoveryScanService[
+      "sanitizeUpdateData"
+    ](scan as unknown as ScanUpdateData);
+
+    expect((data as JSONObject)["statusMessage"]).toBeNull();
+    expect((data as JSONObject)["nextScanAt"]).toBeNull();
+  });
+
+  test("drops _id, createdAt, updatedAt and version even when set (loaded-model updates must not redirect the write or forge timestamps)", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan(
+      ObjectID.generate(),
+    );
+    scan.status = "Completed";
+    (scan as any).createdAt = OneUptimeDate.getCurrentDate();
+    (scan as any).updatedAt = OneUptimeDate.getCurrentDate();
+    (scan as any).version = 7;
+
+    const data: ScanUpdateData = NetworkDeviceDiscoveryScanService[
+      "sanitizeUpdateData"
+    ](scan as unknown as ScanUpdateData);
+
+    expect(Object.keys(data as JSONObject)).toEqual(["status"]);
+  });
+
+  test("keeps entity relation columns that were set", () => {
+    const probeId: ObjectID = ObjectID.generate();
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    scan.status = "Pending";
+    scan.probe = new Probe(probeId);
+
+    const data: ScanUpdateData = NetworkDeviceDiscoveryScanService[
+      "sanitizeUpdateData"
+    ](scan as unknown as ScanUpdateData);
+
+    expect((data as JSONObject)["probe"]).toBeInstanceOf(Probe);
+    expect(((data as JSONObject)["probe"] as Probe).id?.toString()).toBe(
+      probeId.toString(),
+    );
+  });
+
+  test("plain objects pass through by reference, unknown keys and all (typos must keep failing loudly)", () => {
+    const plain: JSONObject = {
+      status: "Completed",
+      someTypoColumn: 1,
+    };
+
+    const data: ScanUpdateData = NetworkDeviceDiscoveryScanService[
+      "sanitizeUpdateData"
+    ](plain as unknown as ScanUpdateData);
+
+    expect(data).toBe(plain);
+    expect(Object.keys(data as JSONObject)).toContain("someTypoColumn");
+  });
+});
+
+describe("DatabaseService._updateBy — updateOneById with a model instance no longer poisons the internal find", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("select columns for the internal find contain only real columns from the data", async () => {
+    const scanId: ObjectID = ObjectID.generate();
+
+    const foundItem: NetworkDeviceDiscoveryScan =
+      new NetworkDeviceDiscoveryScan();
+    foundItem._id = scanId.toString();
+
+    // eslint-disable-next-line @typescript-eslint/typedef
+    const findBySpy = jest
+      .spyOn(NetworkDeviceDiscoveryScanService as any, "_findBy")
+      .mockResolvedValue([foundItem] as never);
+
+    // eslint-disable-next-line @typescript-eslint/typedef
+    const saveMock = jest.fn((item: unknown) => {
+      return Promise.resolve(item);
+    });
+    jest
+      .spyOn(NetworkDeviceDiscoveryScanService, "getRepository")
+      .mockReturnValue({ save: saveMock } as never);
+
+    // Permission layer is not under test here and needs no DB.
+    jest
+      .spyOn(ModelPermission, "checkUpdatePermissionByModel")
+      .mockResolvedValue(undefined as never);
+    jest
+      .spyOn(ModelPermission, "checkUpdateQueryPermissions")
+      .mockImplementation(((
+        _modelType: unknown,
+        query: unknown,
+      ): Promise<unknown> => {
+        return Promise.resolve(query);
+      }) as never);
+
+    const inProgress: NetworkDeviceDiscoveryScan =
+      new NetworkDeviceDiscoveryScan();
+    inProgress.status = "In Progress";
+    inProgress.startedAt = OneUptimeDate.getCurrentDate();
+
+    /*
+     * Before the fix this call rejected with "TableColumnMetadata not found
+     * for isPermissionIf column" — reproducing exactly why discovery scans
+     * never left Pending.
+     */
+    await expect(
+      NetworkDeviceDiscoveryScanService.updateOneById({
+        id: scanId,
+        data: inProgress as unknown as UpdateBy<NetworkDeviceDiscoveryScan>["data"],
+        props: {
+          isRoot: true,
+        },
+      }),
+    ).resolves.toBeUndefined();
+
+    expect(findBySpy).toHaveBeenCalledTimes(1);
+    const findArgs: { select: Select<NetworkDeviceDiscoveryScan> } = (
+      findBySpy.mock.calls[0] as Array<any>
+    )[0];
+    const selectedColumns: Array<string> = Object.keys(findArgs.select);
+
+    // The data columns plus _id and the tenant column — nothing else.
+    expect(selectedColumns.sort()).toEqual(
+      ["_id", "projectId", "startedAt", "status"].sort(),
+    );
+    expect(selectedColumns).not.toContain("isPermissionIf");
+
+    // The persisted payload is the plain data plus the located row's _id.
+    expect(saveMock).toHaveBeenCalledTimes(1);
+    const savedItem: JSONObject = saveMock.mock.calls[0]![0] as JSONObject;
+    expect(Object.keys(savedItem).sort()).toEqual(
+      ["_id", "startedAt", "status"].sort(),
+    );
+    expect(savedItem["status"]).toBe("In Progress");
+    expect(savedItem["_id"]).toBe(scanId.toString());
+  });
+});

package/Tests/Server/Services/UpdateOneByIdKeepsRowId.test.ts

@@ -0,0 +1,107 @@
+import NetworkDeviceDiscoveryScan from "../../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+import NetworkDeviceDiscoveryScanService from "../../../Server/Services/NetworkDeviceDiscoveryScanService";
+import ObjectID from "../../../Types/ObjectID";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Regression tests for the second layer of the discovery-scan "stuck
+ * Pending" bug (the first layer — model instances poisoning the internal
+ * find's select columns — is covered in
+ * DatabaseServiceSanitizeUpdateData.test.ts).
+ *
+ * DatabaseService._updateBy builds the row it saves as a merge of the
+ * located row's _id and the caller's update data. With the old merge order
+ * `{ _id: item._id, ...data }`, update data carrying an own `_id: undefined`
+ * property (a fresh model instance before sanitizeUpdateData existed, or a
+ * plain object that spells it out) clobbered the located row's id — TypeORM
+ * save() saw no primary key, INSERTed a new row instead of updating, and
+ * died on the first NOT NULL column.
+ *
+ * These tests pin the fixed merge order: the located row's _id must win no
+ * matter what shape the update data takes. _findBy is mocked out, so this
+ * exercises the save-payload merge in isolation.
+ */
+
+type SavedRow = { _id?: string; status?: string; startedAt?: Date };
+
+function mockPersistence(existingRowId: string): jest.Mock {
+  const existing: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+  existing._id = existingRowId;
+
+  jest
+    .spyOn(NetworkDeviceDiscoveryScanService as any, "_findBy")
+    .mockResolvedValue([existing] as never);
+
+  const save: jest.Mock = jest
+    .fn()
+    .mockImplementation(async (row: unknown): Promise<unknown> => {
+      return row;
+    });
+
+  jest
+    .spyOn(NetworkDeviceDiscoveryScanService, "getRepository")
+    .mockReturnValue({ save } as any);
+
+  return save;
+}
+
+describe("DatabaseService.updateOneById — saved row keeps the located row's _id", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("when data is a fresh model instance (own undefined _id property)", async () => {
+    const rowId: string = ObjectID.generate().toString();
+    const save: jest.Mock = mockPersistence(rowId);
+
+    const data: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    data.status = "In Progress";
+    data.startedAt = new Date();
+
+    // The bug's precondition: the instance really does carry _id: undefined.
+    expect(Object.keys(data)).toContain("_id");
+
+    await NetworkDeviceDiscoveryScanService.updateOneById({
+      id: new ObjectID(rowId),
+      data: data as never,
+      props: { isRoot: true },
+    });
+
+    expect(save).toHaveBeenCalledTimes(1);
+    const saved: SavedRow = save.mock.calls[0]![0] as SavedRow;
+    expect(saved._id).toBe(rowId);
+    expect(saved.status).toBe("In Progress");
+  });
+
+  test("when data is a plain partial object", async () => {
+    const rowId: string = ObjectID.generate().toString();
+    const save: jest.Mock = mockPersistence(rowId);
+
+    await NetworkDeviceDiscoveryScanService.updateOneById({
+      id: new ObjectID(rowId),
+      data: { status: "In Progress" } as never,
+      props: { isRoot: true },
+    });
+
+    expect(save).toHaveBeenCalledTimes(1);
+    const saved: SavedRow = save.mock.calls[0]![0] as SavedRow;
+    expect(saved._id).toBe(rowId);
+    expect(saved.status).toBe("In Progress");
+  });
+
+  test("when data is a plain object that spells out _id: undefined", async () => {
+    const rowId: string = ObjectID.generate().toString();
+    const save: jest.Mock = mockPersistence(rowId);
+
+    await NetworkDeviceDiscoveryScanService.updateOneById({
+      id: new ObjectID(rowId),
+      data: { _id: undefined, status: "In Progress" } as never,
+      props: { isRoot: true },
+    });
+
+    expect(save).toHaveBeenCalledTimes(1);
+    const saved: SavedRow = save.mock.calls[0]![0] as SavedRow;
+    expect(saved._id).toBe(rowId);
+    expect(saved.status).toBe("In Progress");
+  });
+});

package/Tests/Server/Services/WorkflowService.test.ts

@@ -0,0 +1,308 @@
+/**
+ * WorkflowService trigger denormalization tests.
+ *
+ * The runner never parses workflow graphs. It finds workflows by the
+ * triggerId / triggerArguments columns, which are derived from the graph and
+ * written onto the row. Anything that puts a graph on a workflow without
+ * populating those columns produces a workflow that looks correct in the
+ * builder and silently never fires.
+ *
+ * That is exactly what creating a workflow with a graph already attached does
+ * - importing a JSON export, or duplicating an existing workflow - so the
+ * create path has to denormalize the trigger just like the update path does.
+ *
+ * updateOneById and the outbound call to the workflow service are both spied
+ * on, so no database or network is touched.
+ */
+
+import WorkflowService from "../../../Server/Services/WorkflowService";
+import Workflow from "../../../Models/DatabaseModels/Workflow";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import API from "../../../Utils/API";
+import { afterEach, describe, expect, test, jest } from "@jest/globals";
+
+const WORKFLOW_ID: string = "550e8400-e29b-41d4-a716-446655440000";
+
+function scheduleGraph(): JSONObject {
+  return {
+    nodes: [
+      {
+        id: "node-1",
+        data: {
+          metadataId: "Schedule",
+          componentType: "Trigger",
+          nodeType: "Node",
+          arguments: { "schedule-cron": "0 0 * * *" },
+        },
+      },
+      {
+        id: "node-2",
+        data: {
+          metadataId: "Webhook",
+          componentType: "Component",
+          nodeType: "Node",
+          arguments: {},
+        },
+      },
+    ],
+    edges: [],
+  };
+}
+
+function createdWorkflow(graph: JSONObject | undefined): Workflow {
+  /*
+   * webhookSecretKey is set so onCreateSuccess skips its own key-generation
+   * update, leaving updateOneById calls attributable to trigger derivation.
+   * projectId is left undefined so the fire-and-forget label/owner rule
+   * engines are skipped.
+   */
+  return {
+    _id: WORKFLOW_ID,
+    id: new ObjectID(WORKFLOW_ID),
+    graph: graph,
+    webhookSecretKey: "already-set",
+  } as unknown as Workflow;
+}
+
+function spyOnUpdateOneById(): jest.SpyInstance {
+  return jest
+    .spyOn(WorkflowService, "updateOneById")
+    .mockResolvedValue(undefined as never) as unknown as jest.SpyInstance;
+}
+
+function spyOnApiPost(): jest.SpyInstance {
+  return jest
+    .spyOn(API, "post")
+    .mockResolvedValue({} as never) as unknown as jest.SpyInstance;
+}
+
+type OnCreateSuccessFunction = (
+  onCreate: unknown,
+  createdItem: Workflow,
+) => Promise<Workflow>;
+
+function onCreateSuccess(createdItem: Workflow): Promise<Workflow> {
+  const hook: OnCreateSuccessFunction = (
+    WorkflowService as unknown as { onCreateSuccess: OnCreateSuccessFunction }
+  ).onCreateSuccess.bind(WorkflowService);
+
+  return hook({ createBy: { data: createdItem }, carryForward: null }, {
+    ...createdItem,
+  } as Workflow);
+}
+
+type OnUpdateSuccessFunction = (
+  onUpdate: unknown,
+  updatedItemIds: Array<ObjectID>,
+) => Promise<unknown>;
+
+function onUpdateSuccess(graph: JSONObject | undefined): Promise<unknown> {
+  const hook: OnUpdateSuccessFunction = (
+    WorkflowService as unknown as { onUpdateSuccess: OnUpdateSuccessFunction }
+  ).onUpdateSuccess.bind(WorkflowService);
+
+  return hook(
+    {
+      updateBy: {
+        query: { _id: WORKFLOW_ID },
+        data: graph === undefined ? {} : { graph: graph },
+      },
+    },
+    [new ObjectID(WORKFLOW_ID)],
+  );
+}
+
+describe("WorkflowService trigger denormalization on create", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("writes the trigger from the graph when a workflow is created with one", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+    spyOnApiPost();
+
+    await onCreateSuccess(createdWorkflow(scheduleGraph()));
+
+    expect(updateSpy).toHaveBeenCalledTimes(1);
+
+    const updateArgs: JSONObject = updateSpy.mock.calls[0]![0] as JSONObject;
+    const data: JSONObject = updateArgs["data"] as JSONObject;
+
+    expect(data["triggerId"]).toBe("Schedule");
+    expect(data["triggerArguments"]).toEqual({ "schedule-cron": "0 0 * * *" });
+
+    // must not recurse back through the hooks it is running inside of.
+    expect(updateArgs["props"]).toEqual({ isRoot: true, ignoreHooks: true });
+  });
+
+  test("notifies the workflow service so schedule triggers get registered", async () => {
+    spyOnUpdateOneById();
+    const postSpy: jest.SpyInstance = spyOnApiPost();
+
+    await onCreateSuccess(createdWorkflow(scheduleGraph()));
+
+    expect(postSpy).toHaveBeenCalledTimes(1);
+
+    const postArgs: JSONObject = postSpy.mock.calls[0]![0] as JSONObject;
+
+    expect(postArgs["url"]!.toString()).toContain(
+      `/workflow/update/${WORKFLOW_ID}`,
+    );
+  });
+
+  test("clears the trigger when the graph has no trigger node", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+    spyOnApiPost();
+
+    await onCreateSuccess(
+      createdWorkflow({
+        nodes: [
+          {
+            id: "node-1",
+            data: {
+              metadataId: "Webhook",
+              componentType: "Component",
+              nodeType: "Node",
+              arguments: {},
+            },
+          },
+        ],
+        edges: [],
+      }),
+    );
+
+    const data: JSONObject = (updateSpy.mock.calls[0]![0] as JSONObject)[
+      "data"
+    ] as JSONObject;
+
+    expect(data["triggerId"]).toBeNull();
+    expect(data["triggerArguments"]).toEqual({});
+  });
+
+  test("does no trigger work for a workflow created without a graph", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+    const postSpy: jest.SpyInstance = spyOnApiPost();
+
+    await onCreateSuccess(createdWorkflow(undefined));
+
+    expect(updateSpy).not.toHaveBeenCalled();
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test("does not fail the create when the workflow service is unreachable", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+
+    jest
+      .spyOn(API, "post")
+      .mockRejectedValue(new Error("connect ECONNREFUSED") as never);
+
+    /*
+     * The row and its trigger are already persisted at this point, so a
+     * workflow service outage must not turn a successful import into an error.
+     */
+    await expect(
+      onCreateSuccess(createdWorkflow(scheduleGraph())),
+    ).resolves.toBeDefined();
+
+    expect(updateSpy).toHaveBeenCalledTimes(1);
+  });
+
+  test("derives the trigger for a genuinely imported workflow, which has no webhook secret yet", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+    spyOnApiPost();
+
+    /*
+     * webhookSecretKey carries create: [] access control, so it is stripped
+     * from export files and an imported workflow reaches this hook without
+     * one. That means two updates run in sequence - key generation, then
+     * trigger derivation - and the trigger write must still happen.
+     */
+    const imported: Workflow = {
+      _id: WORKFLOW_ID,
+      id: new ObjectID(WORKFLOW_ID),
+      graph: scheduleGraph(),
+    } as unknown as Workflow;
+
+    await onCreateSuccess(imported);
+
+    expect(updateSpy).toHaveBeenCalledTimes(2);
+
+    const secretUpdate: JSONObject = (
+      updateSpy.mock.calls[0]![0] as JSONObject
+    )["data"] as JSONObject;
+    const triggerUpdate: JSONObject = (
+      updateSpy.mock.calls[1]![0] as JSONObject
+    )["data"] as JSONObject;
+
+    expect(secretUpdate["webhookSecretKey"]).toBeDefined();
+    expect(triggerUpdate["triggerId"]).toBe("Schedule");
+  });
+
+  test("writes no trigger for a graph that carries no nodes key", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+    spyOnApiPost();
+
+    await onCreateSuccess(createdWorkflow({ edges: [] }));
+
+    expect(updateSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe("WorkflowService trigger denormalization on update", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("writes the trigger when a saved graph carries one", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+    spyOnApiPost();
+
+    await onUpdateSuccess(scheduleGraph());
+
+    expect(updateSpy).toHaveBeenCalledTimes(1);
+
+    const data: JSONObject = (updateSpy.mock.calls[0]![0] as JSONObject)[
+      "data"
+    ] as JSONObject;
+
+    expect(data["triggerId"]).toBe("Schedule");
+    expect(data["triggerArguments"]).toEqual({ "schedule-cron": "0 0 * * *" });
+  });
+
+  test("clears the trigger when the trigger node is removed in the builder", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+    spyOnApiPost();
+
+    await onUpdateSuccess({ nodes: [], edges: [] });
+
+    const data: JSONObject = (updateSpy.mock.calls[0]![0] as JSONObject)[
+      "data"
+    ] as JSONObject;
+
+    expect(data["triggerId"]).toBeNull();
+    expect(data["triggerArguments"]).toEqual({});
+  });
+
+  test("touches no trigger columns when an update does not carry the graph", async () => {
+    const updateSpy: jest.SpyInstance = spyOnUpdateOneById();
+    spyOnApiPost();
+
+    // e.g. renaming a workflow must leave its trigger alone.
+    await onUpdateSuccess(undefined);
+
+    expect(updateSpy).not.toHaveBeenCalled();
+  });
+
+  test("always notifies the workflow service so trigger changes take effect", async () => {
+    spyOnUpdateOneById();
+    const postSpy: jest.SpyInstance = spyOnApiPost();
+
+    await onUpdateSuccess(scheduleGraph());
+
+    expect(postSpy).toHaveBeenCalledTimes(1);
+    expect(
+      (postSpy.mock.calls[0]![0] as JSONObject)["url"]!.toString(),
+    ).toContain(`/workflow/update/${WORKFLOW_ID}`);
+  });
+});