@oneuptime/common 11.6.1 → 11.6.2

package/Tests/Utils/NetworkSite/CidrMatchUtil.test.ts

@@ -0,0 +1,440 @@
+import CidrMatchUtil, {
+  AssignmentRuleCandidate,
+} from "../../../Utils/NetworkSite/CidrMatchUtil";
+
+describe("CidrMatchUtil.ipInCidr", () => {
+  it("matches inside a /24", () => {
+    expect(CidrMatchUtil.ipInCidr("192.168.1.0", "192.168.1.0/24")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("192.168.1.1", "192.168.1.0/24")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("192.168.1.255", "192.168.1.0/24")).toBe(
+      true,
+    );
+  });
+
+  it("rejects the adjacent /24", () => {
+    expect(CidrMatchUtil.ipInCidr("192.168.2.0", "192.168.1.0/24")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("192.168.0.255", "192.168.1.0/24")).toBe(
+      false,
+    );
+  });
+
+  it("/0 matches every valid address", () => {
+    expect(CidrMatchUtil.ipInCidr("0.0.0.0", "0.0.0.0/0")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("255.255.255.255", "0.0.0.0/0")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("10.20.30.40", "192.168.0.0/0")).toBe(true);
+  });
+
+  it("/32 matches only the exact address", () => {
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.1/32")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.2", "10.0.0.1/32")).toBe(false);
+  });
+
+  it("/31 matches exactly the two-address pair", () => {
+    expect(CidrMatchUtil.ipInCidr("10.0.0.0", "10.0.0.0/31")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.0/31")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.2", "10.0.0.0/31")).toBe(false);
+  });
+
+  it("handles the high bit correctly (unsigned math)", () => {
+    expect(CidrMatchUtil.ipInCidr("200.1.2.3", "200.0.0.0/8")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("100.1.2.3", "200.0.0.0/8")).toBe(false);
+    expect(
+      CidrMatchUtil.ipInCidr("255.255.255.254", "255.255.255.254/32"),
+    ).toBe(true);
+  });
+
+  it("treats a bare address as /32", () => {
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.1")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.2", "10.0.0.1")).toBe(false);
+  });
+
+  it("rejects octet overflow", () => {
+    expect(CidrMatchUtil.ipInCidr("10.0.0.256", "10.0.0.0/8")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.256/8")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("999.0.0.1", "0.0.0.0/0")).toBe(false);
+  });
+
+  it("rejects prefixes outside 0-32", () => {
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.0/33")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.0/99")).toBe(false);
+  });
+
+  it("rejects malformed prefixes", () => {
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.0/a")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.0/-1")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.0/")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "10.0.0.0/8/8")).toBe(false);
+  });
+
+  it("rejects malformed addresses", () => {
+    expect(CidrMatchUtil.ipInCidr("10.0.0", "10.0.0.0/8")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.0.1", "10.0.0.0/8")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.x", "10.0.0.0/8")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("", "10.0.0.0/8")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("switch-01.example.com", "10.0.0.0/8")).toBe(
+      false,
+    );
+    expect(CidrMatchUtil.ipInCidr("10.0.0.+1", "10.0.0.0/8")).toBe(false);
+  });
+
+  it("rejects garbage cidr inputs", () => {
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "garbage")).toBe(false);
+    expect(CidrMatchUtil.ipInCidr("10.0.0.1", "/24")).toBe(false);
+    expect(
+      CidrMatchUtil.ipInCidr(
+        undefined as unknown as string,
+        null as unknown as string,
+      ),
+    ).toBe(false);
+  });
+
+  it("tolerates surrounding whitespace and leading zeros", () => {
+    expect(CidrMatchUtil.ipInCidr(" 10.0.0.1 ", " 10.0.0.0/8 ")).toBe(true);
+    expect(CidrMatchUtil.ipInCidr("010.0.0.1", "10.0.0.0/8")).toBe(true);
+  });
+});
+
+describe("CidrMatchUtil.isValidCidr", () => {
+  it("accepts well-formed CIDRs and bare addresses", () => {
+    expect(CidrMatchUtil.isValidCidr("10.0.0.0/8")).toBe(true);
+    expect(CidrMatchUtil.isValidCidr("0.0.0.0/0")).toBe(true);
+    expect(CidrMatchUtil.isValidCidr("255.255.255.255/32")).toBe(true);
+    expect(CidrMatchUtil.isValidCidr("10.0.0.1")).toBe(true);
+  });
+
+  it("rejects malformed input", () => {
+    expect(CidrMatchUtil.isValidCidr("10.0.0.0/33")).toBe(false);
+    expect(CidrMatchUtil.isValidCidr("10.0.0/8")).toBe(false);
+    expect(CidrMatchUtil.isValidCidr("10.0.0.0/x")).toBe(false);
+    expect(CidrMatchUtil.isValidCidr("")).toBe(false);
+    expect(CidrMatchUtil.isValidCidr("hostname/24")).toBe(false);
+  });
+});
+
+describe("CidrMatchUtil.hostnameMatchesWildcard", () => {
+  it("matches exact names case-insensitively", () => {
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("Switch-01", "switch-01"),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("switch-01", "SWITCH-01"),
+    ).toBe(true);
+  });
+
+  it("supports leading, trailing and inner wildcards", () => {
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("unit-1042-sw1", "unit-*"),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard(
+        "core.example.com",
+        "*.example.com",
+      ),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("unit-1042-sw1", "unit-*-sw1"),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("unit-1042-sw2", "unit-*-sw1"),
+    ).toBe(false);
+  });
+
+  it("supports multiple wildcards", () => {
+    expect(CidrMatchUtil.hostnameMatchesWildcard("a-b-c-d", "*-b-*-d")).toBe(
+      true,
+    );
+  });
+
+  it("a lone * matches anything including the empty string", () => {
+    expect(CidrMatchUtil.hostnameMatchesWildcard("anything", "*")).toBe(true);
+    expect(CidrMatchUtil.hostnameMatchesWildcard("", "*")).toBe(true);
+  });
+
+  it("* matches zero characters", () => {
+    expect(CidrMatchUtil.hostnameMatchesWildcard("unit-", "unit-*")).toBe(true);
+  });
+
+  it("requires a full match (no substring matching)", () => {
+    expect(CidrMatchUtil.hostnameMatchesWildcard("myunit-1", "unit-*")).toBe(
+      false,
+    );
+    expect(CidrMatchUtil.hostnameMatchesWildcard("unit-1x", "unit-1")).toBe(
+      false,
+    );
+  });
+
+  it("treats regex metacharacters as literals (dot is literal)", () => {
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard(
+        "sw1.example.com",
+        "sw1.example.com",
+      ),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard(
+        "sw1xexampleycom",
+        "sw1.example.com",
+      ),
+    ).toBe(false);
+    expect(CidrMatchUtil.hostnameMatchesWildcard("a+b", "a+b")).toBe(true);
+    expect(CidrMatchUtil.hostnameMatchesWildcard("aab", "a+b")).toBe(false);
+  });
+
+  it("empty pattern matches only the empty hostname", () => {
+    expect(CidrMatchUtil.hostnameMatchesWildcard("", "")).toBe(true);
+    expect(CidrMatchUtil.hostnameMatchesWildcard("host", "")).toBe(false);
+  });
+
+  it("non-string inputs never match", () => {
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard(
+        undefined as unknown as string,
+        "*",
+      ),
+    ).toBe(false);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("host", null as unknown as string),
+    ).toBe(false);
+  });
+
+  it("trims surrounding whitespace", () => {
+    expect(CidrMatchUtil.hostnameMatchesWildcard(" host ", "host")).toBe(true);
+    expect(CidrMatchUtil.hostnameMatchesWildcard("host", " host ")).toBe(true);
+  });
+
+  it("consecutive wildcards collapse rather than multiplying the work", () => {
+    expect(CidrMatchUtil.hostnameMatchesWildcard("unit-1042-sw1", "**")).toBe(
+      true,
+    );
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("unit-1042-sw1", "unit-***-sw1"),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("unit-1042-sw2", "unit-***-sw1"),
+    ).toBe(false);
+  });
+
+  /*
+   * Regression: this pattern/hostname pair compiled to
+   * /^.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*b$/i, which the backtracking regex
+   * engine takes minutes to reject — a single assignment rule row could wedge
+   * the API/worker event loop on every device create or update.
+   */
+  it("rejects a catastrophic-backtracking pattern immediately", () => {
+    const pattern: string = `${"*a".repeat(12)}*b`;
+    const hostname: string = "a".repeat(60);
+
+    const startedAt: number = Date.now();
+    expect(CidrMatchUtil.hostnameMatchesWildcard(hostname, pattern)).toBe(
+      false,
+    );
+    expect(Date.now() - startedAt).toBeLessThan(1000);
+  });
+
+  it("stays fast on the pathological pattern even when it does match", () => {
+    const pattern: string = `${"*a".repeat(12)}*b`;
+    const hostname: string = `${"a".repeat(60)}b`;
+
+    const startedAt: number = Date.now();
+    expect(CidrMatchUtil.hostnameMatchesWildcard(hostname, pattern)).toBe(true);
+    expect(Date.now() - startedAt).toBeLessThan(1000);
+  });
+
+  it("refuses patterns longer than the 253-character DNS maximum", () => {
+    expect(CidrMatchUtil.MAX_HOSTNAME_PATTERN_LENGTH).toBe(253);
+
+    const atLimit: string = `${"a".repeat(252)}*`;
+    expect(atLimit.length).toBe(253);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("a".repeat(252), atLimit),
+    ).toBe(true);
+
+    const overLimit: string = `${"a".repeat(253)}*`;
+    expect(overLimit.length).toBe(254);
+    expect(
+      CidrMatchUtil.hostnameMatchesWildcard("a".repeat(253), overLimit),
+    ).toBe(false);
+  });
+});
+
+describe("CidrMatchUtil.ruleMatches", () => {
+  it("matches a cidr-only rule against the target ip", () => {
+    expect(
+      CidrMatchUtil.ruleMatches(
+        { subnetCidr: "10.0.0.0/8" },
+        { ip: "10.1.2.3" },
+      ),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.ruleMatches(
+        { subnetCidr: "10.0.0.0/8" },
+        { ip: "11.1.2.3" },
+      ),
+    ).toBe(false);
+  });
+
+  it("a cidr rule cannot match a target without an ip", () => {
+    expect(
+      CidrMatchUtil.ruleMatches(
+        { subnetCidr: "10.0.0.0/8" },
+        { hostname: "sw1" },
+      ),
+    ).toBe(false);
+  });
+
+  it("matches a hostname-pattern rule against hostname or sysName", () => {
+    expect(
+      CidrMatchUtil.ruleMatches(
+        { hostnamePattern: "unit-*" },
+        { hostname: "unit-1" },
+      ),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.ruleMatches(
+        { hostnamePattern: "unit-*" },
+        { hostname: "10.0.0.5", sysName: "unit-1-core" },
+      ),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.ruleMatches(
+        { hostnamePattern: "unit-*" },
+        { hostname: "other", sysName: "different" },
+      ),
+    ).toBe(false);
+  });
+
+  it("requires BOTH criteria to match when both are set", () => {
+    const rule: AssignmentRuleCandidate = {
+      subnetCidr: "10.0.0.0/8",
+      hostnamePattern: "unit-*",
+    };
+    expect(
+      CidrMatchUtil.ruleMatches(rule, {
+        ip: "10.0.0.1",
+        sysName: "unit-1",
+      }),
+    ).toBe(true);
+    expect(
+      CidrMatchUtil.ruleMatches(rule, {
+        ip: "11.0.0.1",
+        sysName: "unit-1",
+      }),
+    ).toBe(false);
+    expect(
+      CidrMatchUtil.ruleMatches(rule, {
+        ip: "10.0.0.1",
+        sysName: "core-1",
+      }),
+    ).toBe(false);
+  });
+
+  it("a rule with no criteria never matches", () => {
+    expect(
+      CidrMatchUtil.ruleMatches({}, { ip: "10.0.0.1", hostname: "any" }),
+    ).toBe(false);
+    expect(
+      CidrMatchUtil.ruleMatches(
+        { subnetCidr: "  ", hostnamePattern: "" },
+        { ip: "10.0.0.1" },
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("CidrMatchUtil.pickRule", () => {
+  interface TestRule extends AssignmentRuleCandidate {
+    name: string;
+  }
+
+  const target: { ip: string; hostname: string } = {
+    ip: "10.0.5.9",
+    hostname: "unit-1042-sw1",
+  };
+
+  it("returns null when nothing matches", () => {
+    expect(
+      CidrMatchUtil.pickRule<TestRule>(
+        [{ name: "r1", subnetCidr: "192.168.0.0/16", priority: 100 }],
+        target,
+      ),
+    ).toBeNull();
+    expect(CidrMatchUtil.pickRule<TestRule>([], target)).toBeNull();
+  });
+
+  it("the highest priority number wins", () => {
+    const winner: TestRule | null = CidrMatchUtil.pickRule<TestRule>(
+      [
+        { name: "broad", subnetCidr: "10.0.0.0/8", priority: 1 },
+        { name: "narrow", subnetCidr: "10.0.5.0/24", priority: 10 },
+      ],
+      target,
+    );
+    expect(winner?.name).toBe("narrow");
+  });
+
+  it("a non-matching high-priority rule is skipped", () => {
+    const winner: TestRule | null = CidrMatchUtil.pickRule<TestRule>(
+      [
+        { name: "wrong-subnet", subnetCidr: "172.16.0.0/12", priority: 999 },
+        { name: "matching", subnetCidr: "10.0.0.0/8", priority: 1 },
+      ],
+      target,
+    );
+    expect(winner?.name).toBe("matching");
+  });
+
+  it("priority ties go to the earlier createdAt", () => {
+    const winner: TestRule | null = CidrMatchUtil.pickRule<TestRule>(
+      [
+        {
+          name: "newer",
+          subnetCidr: "10.0.0.0/8",
+          priority: 5,
+          createdAt: new Date("2026-02-01T00:00:00Z"),
+        },
+        {
+          name: "older",
+          subnetCidr: "10.0.0.0/8",
+          priority: 5,
+          createdAt: new Date("2026-01-01T00:00:00Z"),
+        },
+      ],
+      target,
+    );
+    expect(winner?.name).toBe("older");
+  });
+
+  it("priority ties without createdAt keep the first rule (stable)", () => {
+    const winner: TestRule | null = CidrMatchUtil.pickRule<TestRule>(
+      [
+        { name: "first", subnetCidr: "10.0.0.0/8", priority: 5 },
+        { name: "second", subnetCidr: "10.0.0.0/8", priority: 5 },
+      ],
+      target,
+    );
+    expect(winner?.name).toBe("first");
+  });
+
+  it("missing priority is treated as 0", () => {
+    const winner: TestRule | null = CidrMatchUtil.pickRule<TestRule>(
+      [
+        { name: "no-priority", subnetCidr: "10.0.0.0/8" },
+        { name: "priority-1", subnetCidr: "10.0.0.0/8", priority: 1 },
+      ],
+      target,
+    );
+    expect(winner?.name).toBe("priority-1");
+  });
+
+  it("mixes cidr and hostname rules", () => {
+    const winner: TestRule | null = CidrMatchUtil.pickRule<TestRule>(
+      [
+        { name: "by-subnet", subnetCidr: "10.0.0.0/8", priority: 1 },
+        { name: "by-hostname", hostnamePattern: "unit-1042-*", priority: 2 },
+      ],
+      target,
+    );
+    expect(winner?.name).toBe("by-hostname");
+  });
+});

package/Tests/Utils/NetworkSite/MaterializedPathUtil.test.ts

@@ -0,0 +1,205 @@
+import MaterializedPathUtil from "../../../Utils/NetworkSite/MaterializedPathUtil";
+
+describe("MaterializedPathUtil.buildPath", () => {
+  it("builds a root path from a null parent path", () => {
+    expect(MaterializedPathUtil.buildPath(null, "a")).toBe("/a/");
+  });
+
+  it("builds a root path from an undefined parent path", () => {
+    expect(MaterializedPathUtil.buildPath(undefined, "a")).toBe("/a/");
+  });
+
+  it("builds a root path from an empty parent path", () => {
+    expect(MaterializedPathUtil.buildPath("", "a")).toBe("/a/");
+  });
+
+  it("appends the site id to the parent path", () => {
+    expect(MaterializedPathUtil.buildPath("/a/", "b")).toBe("/a/b/");
+  });
+
+  it("builds deep paths", () => {
+    expect(MaterializedPathUtil.buildPath("/a/b/c/", "d")).toBe("/a/b/c/d/");
+  });
+
+  it("normalizes a parent path missing its trailing slash", () => {
+    expect(MaterializedPathUtil.buildPath("/a/b", "c")).toBe("/a/b/c/");
+  });
+
+  it("normalizes a parent path missing its leading slash", () => {
+    expect(MaterializedPathUtil.buildPath("a/b/", "c")).toBe("/a/b/c/");
+  });
+
+  it("collapses duplicate slashes in the parent path", () => {
+    expect(MaterializedPathUtil.buildPath("//a//b//", "c")).toBe("/a/b/c/");
+  });
+
+  it("treats a bare slash parent as root", () => {
+    expect(MaterializedPathUtil.buildPath("/", "a")).toBe("/a/");
+  });
+});
+
+describe("MaterializedPathUtil.segmentsOf", () => {
+  it("splits a path into ids", () => {
+    expect(MaterializedPathUtil.segmentsOf("/a/b/c/")).toEqual(["a", "b", "c"]);
+  });
+
+  it("returns [] for null, undefined and empty", () => {
+    expect(MaterializedPathUtil.segmentsOf(null)).toEqual([]);
+    expect(MaterializedPathUtil.segmentsOf(undefined)).toEqual([]);
+    expect(MaterializedPathUtil.segmentsOf("")).toEqual([]);
+  });
+
+  it("ignores empty segments", () => {
+    expect(MaterializedPathUtil.segmentsOf("///a///b//")).toEqual(["a", "b"]);
+  });
+
+  it("returns [] for a bare slash", () => {
+    expect(MaterializedPathUtil.segmentsOf("/")).toEqual([]);
+  });
+});
+
+describe("MaterializedPathUtil.depthOf", () => {
+  it("is 0 for a root path", () => {
+    expect(MaterializedPathUtil.depthOf("/a/")).toBe(0);
+  });
+
+  it("counts ancestors for nested paths", () => {
+    expect(MaterializedPathUtil.depthOf("/a/b/")).toBe(1);
+    expect(MaterializedPathUtil.depthOf("/a/b/c/d/")).toBe(3);
+  });
+
+  it("is 0 for empty or invalid paths", () => {
+    expect(MaterializedPathUtil.depthOf("")).toBe(0);
+    expect(MaterializedPathUtil.depthOf(null)).toBe(0);
+    expect(MaterializedPathUtil.depthOf(undefined)).toBe(0);
+    expect(MaterializedPathUtil.depthOf("/")).toBe(0);
+  });
+});
+
+describe("MaterializedPathUtil.isDescendant", () => {
+  it("is true for a strict descendant", () => {
+    expect(MaterializedPathUtil.isDescendant("/a/b/", "/a/")).toBe(true);
+    expect(MaterializedPathUtil.isDescendant("/a/b/c/", "/a/")).toBe(true);
+  });
+
+  it("is false for the same path (a site is not its own descendant)", () => {
+    expect(MaterializedPathUtil.isDescendant("/a/", "/a/")).toBe(false);
+  });
+
+  it("is false for unrelated paths", () => {
+    expect(MaterializedPathUtil.isDescendant("/x/y/", "/a/")).toBe(false);
+  });
+
+  it("is false for an ancestor (direction matters)", () => {
+    expect(MaterializedPathUtil.isDescendant("/a/", "/a/b/")).toBe(false);
+  });
+
+  it("does not treat an id sharing a prefix as a descendant", () => {
+    // '/ab/' is NOT under '/a/' - the trailing slash protects the boundary.
+    expect(MaterializedPathUtil.isDescendant("/ab/", "/a/")).toBe(false);
+    expect(MaterializedPathUtil.isDescendant("/ab/c/", "/a/")).toBe(false);
+  });
+
+  it("is false when either path is missing", () => {
+    expect(MaterializedPathUtil.isDescendant(null, "/a/")).toBe(false);
+    expect(MaterializedPathUtil.isDescendant("/a/b/", null)).toBe(false);
+    expect(MaterializedPathUtil.isDescendant(undefined, undefined)).toBe(false);
+  });
+});
+
+describe("MaterializedPathUtil.wouldCreateCycle", () => {
+  it("detects re-parenting under a descendant", () => {
+    // Moving 'a' under '/a/b/' (its own child) is a cycle.
+    expect(MaterializedPathUtil.wouldCreateCycle("a", "/a/b/")).toBe(true);
+  });
+
+  it("detects re-parenting under itself", () => {
+    expect(MaterializedPathUtil.wouldCreateCycle("a", "/a/")).toBe(true);
+  });
+
+  it("detects the site id anywhere in the parent chain", () => {
+    expect(MaterializedPathUtil.wouldCreateCycle("b", "/a/b/c/")).toBe(true);
+  });
+
+  it("allows re-parenting under an unrelated site", () => {
+    expect(MaterializedPathUtil.wouldCreateCycle("a", "/x/y/")).toBe(false);
+  });
+
+  it("allows becoming a root (no parent path)", () => {
+    expect(MaterializedPathUtil.wouldCreateCycle("a", null)).toBe(false);
+    expect(MaterializedPathUtil.wouldCreateCycle("a", undefined)).toBe(false);
+    expect(MaterializedPathUtil.wouldCreateCycle("a", "")).toBe(false);
+  });
+
+  it("does not confuse ids that share a prefix", () => {
+    expect(MaterializedPathUtil.wouldCreateCycle("a", "/ab/")).toBe(false);
+    expect(MaterializedPathUtil.wouldCreateCycle("ab", "/a/")).toBe(false);
+  });
+
+  it("is false for an empty site id", () => {
+    expect(MaterializedPathUtil.wouldCreateCycle("", "/a/")).toBe(false);
+  });
+});
+
+describe("MaterializedPathUtil.rebasePaths", () => {
+  it("rewrites the moved subtree's prefix", () => {
+    expect(
+      MaterializedPathUtil.rebasePaths("/a/b/", "/x/b/", [
+        "/a/b/",
+        "/a/b/c/",
+        "/a/b/c/d/",
+      ]),
+    ).toEqual(["/x/b/", "/x/b/c/", "/x/b/c/d/"]);
+  });
+
+  it("leaves paths outside the subtree unchanged", () => {
+    expect(
+      MaterializedPathUtil.rebasePaths("/a/b/", "/x/b/", ["/a/", "/a/z/"]),
+    ).toEqual(["/a/", "/a/z/"]);
+  });
+
+  it("supports moving a subtree to the root", () => {
+    expect(
+      MaterializedPathUtil.rebasePaths("/a/b/", "/b/", ["/a/b/", "/a/b/c/"]),
+    ).toEqual(["/b/", "/b/c/"]);
+  });
+
+  it("supports moving a root subtree under another site", () => {
+    expect(
+      MaterializedPathUtil.rebasePaths("/b/", "/a/b/", ["/b/", "/b/c/"]),
+    ).toEqual(["/a/b/", "/a/b/c/"]);
+  });
+
+  it("does not rebase ids that merely share a prefix with the old path", () => {
+    expect(
+      MaterializedPathUtil.rebasePaths("/a/b/", "/x/b/", ["/a/bc/"]),
+    ).toEqual(["/a/bc/"]);
+  });
+
+  it("preserves input order", () => {
+    expect(
+      MaterializedPathUtil.rebasePaths("/a/", "/z/a/", [
+        "/other/",
+        "/a/x/",
+        "/other2/",
+        "/a/",
+      ]),
+    ).toEqual(["/other/", "/z/a/x/", "/other2/", "/z/a/"]);
+  });
+
+  it("returns [] for an empty affected list", () => {
+    expect(MaterializedPathUtil.rebasePaths("/a/", "/b/", [])).toEqual([]);
+  });
+
+  it("works with uuid-shaped segments", () => {
+    const root: string = "5f8b9c0d-e1a2-4b3c-8d5e-6f7a8b9c0d1e";
+    const child: string = "11111111-2222-4333-8444-555555555555";
+    const newRoot: string = "99999999-8888-4777-8666-555555555555";
+
+    expect(
+      MaterializedPathUtil.rebasePaths(`/${root}/`, `/${newRoot}/${root}/`, [
+        `/${root}/${child}/`,
+      ]),
+    ).toEqual([`/${newRoot}/${root}/${child}/`]);
+  });
+});