@oneuptime/common 11.5.13 → 11.6.1

package/Tests/Server/Utils/Attribution.test.ts

@@ -0,0 +1,203 @@
+import Attribution from "../../../Server/Utils/Attribution";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, test } from "@jest/globals";
+
+describe("Attribution", () => {
+  describe("sanitizeClickIds", () => {
+    test("keeps every supported ad-platform click identifier", () => {
+      const clickIds: JSONObject = {
+        gclid: "google-click",
+        wbraid: "google-web-to-app",
+        gbraid: "google-app-to-web",
+        fbclid: "meta-click",
+        msclkid: "microsoft-click",
+        li_fat_id: "linkedin-click",
+        twclid: "x-click",
+        rdt_cid: "reddit-click",
+      };
+
+      expect(Attribution.sanitizeClickIds(clickIds)).toEqual(clickIds);
+    });
+
+    test("drops keys that are not explicitly allowlisted", () => {
+      expect(
+        Attribution.sanitizeClickIds({
+          gclid: "valid",
+          attackerControlledKey: "must-not-persist",
+          __proto__: "must-not-persist",
+        }),
+      ).toEqual({ gclid: "valid" });
+    });
+
+    test.each([null, undefined, "gclid=x", 42, true, ["gclid"]])(
+      "rejects a non-object value: %p",
+      (value: unknown) => {
+        expect(Attribution.sanitizeClickIds(value as never)).toBeUndefined();
+      },
+    );
+
+    test("drops empty, boolean and object click-id values", () => {
+      expect(
+        Attribution.sanitizeClickIds({
+          gclid: "",
+          fbclid: false,
+          msclkid: { nested: "value" },
+        }),
+      ).toBeUndefined();
+    });
+
+    test("normalizes numeric identifiers to strings", () => {
+      expect(
+        Attribution.sanitizeClickIds({
+          gclid: 12345,
+          msclkid: 67890,
+        }),
+      ).toEqual({
+        gclid: "12345",
+        msclkid: "67890",
+      });
+    });
+
+    test("caps each identifier at 500 characters", () => {
+      const result: JSONObject | undefined = Attribution.sanitizeClickIds({
+        gclid: "g".repeat(600),
+        fbclid: "f".repeat(501),
+      });
+
+      expect(result?.["gclid"]).toBe("g".repeat(500));
+      expect(result?.["fbclid"]).toBe("f".repeat(500));
+    });
+
+    test("returns a fresh object instead of retaining the untrusted input", () => {
+      const input: JSONObject = { gclid: "original" };
+      const result: JSONObject | undefined =
+        Attribution.sanitizeClickIds(input);
+
+      input["gclid"] = "mutated";
+
+      expect(result).toEqual({ gclid: "original" });
+      expect(result).not.toBe(input);
+    });
+  });
+
+  describe("sanitizeFirstTouchAttribution", () => {
+    test("keeps the complete supported first-touch payload", () => {
+      const firstTouch: JSONObject = {
+        utmSource: "google",
+        utmMedium: "cpc",
+        utmCampaign: "pagerduty-alternative",
+        utmTerm: "pagerduty alternative",
+        utmContent: "comparison-ad-a",
+        landingUrl: "https://oneuptime.com/compare/pagerduty?gclid=abc",
+        referrer: "https://google.com/",
+        timestamp: "2026-07-22T10:00:00.000Z",
+        clickIds: {
+          gclid: "abc",
+          msclkid: "def",
+        },
+      };
+
+      expect(Attribution.sanitizeFirstTouchAttribution(firstTouch)).toEqual(
+        firstTouch,
+      );
+    });
+
+    test("drops unknown top-level and nested click-id keys", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          utmSource: "google",
+          arbitrary: "do-not-store",
+          clickIds: {
+            gclid: "valid",
+            arbitraryClickId: "do-not-store",
+          },
+        }),
+      ).toEqual({
+        utmSource: "google",
+        clickIds: { gclid: "valid" },
+      });
+    });
+
+    test("keeps valid first-touch fields when clickIds is malformed", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          utmSource: "newsletter",
+          clickIds: ["not", "an", "object"],
+        }),
+      ).toEqual({ utmSource: "newsletter" });
+    });
+
+    test("keeps valid click IDs when no UTM values exist", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          clickIds: { gclid: "auto-tagged-click" },
+        }),
+      ).toEqual({
+        clickIds: { gclid: "auto-tagged-click" },
+      });
+    });
+
+    test("caps all first-touch strings and nested click IDs", () => {
+      const result: JSONObject | undefined =
+        Attribution.sanitizeFirstTouchAttribution({
+          utmCampaign: "c".repeat(700),
+          landingUrl: "l".repeat(700),
+          clickIds: { gclid: "g".repeat(700) },
+        });
+
+      expect(result?.["utmCampaign"]).toBe("c".repeat(500));
+      expect(result?.["landingUrl"]).toBe("l".repeat(500));
+      expect((result?.["clickIds"] as JSONObject)?.["gclid"]).toBe(
+        "g".repeat(500),
+      );
+    });
+
+    test("normalizes numeric scalar values", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          utmCampaign: 2026,
+          timestamp: 123456,
+        }),
+      ).toEqual({
+        utmCampaign: "2026",
+        timestamp: "123456",
+      });
+    });
+
+    test.each([null, undefined, "utm_source=google", 42, true, []])(
+      "rejects a non-object first-touch value: %p",
+      (value: unknown) => {
+        expect(
+          Attribution.sanitizeFirstTouchAttribution(value as never),
+        ).toBeUndefined();
+      },
+    );
+
+    test("returns undefined when every supplied field is invalid", () => {
+      expect(
+        Attribution.sanitizeFirstTouchAttribution({
+          unsupported: "value",
+          clickIds: { unsupported: "value" },
+        }),
+      ).toBeUndefined();
+    });
+
+    test("does not retain mutable nested input objects", () => {
+      const clickIds: JSONObject = { gclid: "original" };
+      const input: JSONObject = {
+        utmSource: "google",
+        clickIds,
+      };
+      const result: JSONObject | undefined =
+        Attribution.sanitizeFirstTouchAttribution(input);
+
+      clickIds["gclid"] = "mutated";
+      input["utmSource"] = "mutated";
+
+      expect(result).toEqual({
+        utmSource: "google",
+        clickIds: { gclid: "original" },
+      });
+    });
+  });
+});

package/Tests/Server/Utils/Marketing/ConversionUploadProvider.test.ts

@@ -0,0 +1,183 @@
+import MarketingConversion from "../../../../Models/DatabaseModels/MarketingConversion";
+import ConversionUploadProvider, {
+  ConversionSkip,
+  ConversionUploadBatchResult,
+} from "../../../../Server/Utils/Marketing/ConversionUploadProvider";
+import { MarketingConversionType } from "../../../../Types/Marketing/MarketingConversion";
+import { AxiosError } from "axios";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+class TestProvider extends ConversionUploadProvider {
+  public override readonly key: string = "test";
+  public override readonly displayName: string = "Test Provider";
+
+  public override isConfigured(): boolean {
+    return true;
+  }
+
+  public override getSkipReason(
+    _conversion: MarketingConversion,
+  ): ConversionSkip | null {
+    return null;
+  }
+
+  public override async upload(
+    _conversions: Array<MarketingConversion>,
+  ): Promise<ConversionUploadBatchResult> {
+    return { permanentFailures: new Map<number, string>() };
+  }
+
+  public readClickId(
+    conversion: MarketingConversion,
+    key: string,
+  ): string | undefined {
+    return this.getClickId(conversion, key);
+  }
+
+  public readValueInUSD(conversion: MarketingConversion): number | undefined {
+    return this.getValueInUSD(conversion);
+  }
+
+  public readIsSignUp(conversion: MarketingConversion): boolean {
+    return this.isSignUp(conversion);
+  }
+
+  public readIsOlderThanDays(
+    conversion: MarketingConversion,
+    days: number,
+  ): boolean {
+    return this.isOlderThanDays(conversion, days);
+  }
+}
+
+const makeConversion: (
+  data?: Partial<MarketingConversion>,
+) => MarketingConversion = (
+  data: Partial<MarketingConversion> = {},
+): MarketingConversion => {
+  return Object.assign(new MarketingConversion(), data);
+};
+
+describe("ConversionUploadProvider", () => {
+  const provider: TestProvider = new TestProvider();
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("extracts a non-empty string click ID", () => {
+    const conversion: MarketingConversion = makeConversion({
+      clickIds: { gclid: "google-click" },
+    });
+
+    expect(provider.readClickId(conversion, "gclid")).toBe("google-click");
+  });
+
+  test.each([undefined, null, "", 0, 123, false, { nested: true }])(
+    "rejects an invalid click ID value: %p",
+    (value: unknown) => {
+      const conversion: MarketingConversion = makeConversion({
+        clickIds: { gclid: value as never },
+      });
+
+      expect(provider.readClickId(conversion, "gclid")).toBeUndefined();
+    },
+  );
+
+  test("returns undefined when click IDs are absent", () => {
+    const conversion: MarketingConversion = makeConversion();
+    delete conversion.clickIds;
+
+    expect(provider.readClickId(conversion, "gclid")).toBeUndefined();
+  });
+
+  test("converts cents to an exact USD decimal", () => {
+    expect(
+      provider.readValueInUSD(
+        makeConversion({ conversionValueInUSDCents: 12345 }),
+      ),
+    ).toBe(123.45);
+  });
+
+  test.each([undefined, null, 0, -1, -100])(
+    "omits a non-positive or missing conversion value: %p",
+    (value: number | null | undefined) => {
+      const conversion: MarketingConversion = makeConversion();
+      conversion.conversionValueInUSDCents = value as never;
+
+      expect(provider.readValueInUSD(conversion)).toBeUndefined();
+    },
+  );
+
+  test("classifies only the SignUp conversion type as a signup", () => {
+    expect(
+      provider.readIsSignUp(
+        makeConversion({ conversionType: MarketingConversionType.SignUp }),
+      ),
+    ).toBe(true);
+    expect(
+      provider.readIsSignUp(
+        makeConversion({
+          conversionType: MarketingConversionType.PaidSubscription,
+        }),
+      ),
+    ).toBe(false);
+  });
+
+  test("checks conversion age against the provider window", () => {
+    jest
+      .spyOn(Date, "now")
+      .mockReturnValue(new Date("2026-07-22T12:00:00.000Z").getTime());
+
+    expect(
+      provider.readIsOlderThanDays(
+        makeConversion({
+          conversionAt: new Date("2026-04-22T11:59:59.999Z"),
+        }),
+        90,
+      ),
+    ).toBe(true);
+    expect(
+      provider.readIsOlderThanDays(
+        makeConversion({
+          conversionAt: new Date("2026-07-21T12:00:00.000Z"),
+        }),
+        90,
+      ),
+    ).toBe(false);
+  });
+
+  test("uses the current time when conversionAt is missing", () => {
+    jest
+      .spyOn(Date, "now")
+      .mockReturnValue(new Date("2026-07-22T12:00:00.000Z").getTime());
+
+    expect(provider.readIsOlderThanDays(makeConversion(), 90)).toBe(false);
+  });
+
+  test("formats ordinary errors without leaking an object dump", () => {
+    expect(
+      ConversionUploadProvider.getErrorMessage(new Error("network down")),
+    ).toBe("network down");
+  });
+
+  test("formats Axios errors with status and bounded response data", () => {
+    const error: AxiosError = new AxiosError("rate limited");
+    Object.assign(error, {
+      response: {
+        status: 429,
+        data: { error: "retry later" },
+      },
+    });
+
+    expect(ConversionUploadProvider.getErrorMessage(error)).toBe(
+      'HTTP 429: {"error":"retry later"}',
+    );
+  });
+
+  test("falls back to Unknown error for non-error values", () => {
+    expect(ConversionUploadProvider.getErrorMessage(null)).toBe(
+      "Unknown error",
+    );
+  });
+});