@oneuptime/common 11.7.1 → 11.7.2

package/Tests/Server/API/MicrosoftTeamsManifest.test.ts

@@ -0,0 +1,228 @@
+import { describe, expect, test, afterEach } from "@jest/globals";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import MicrosoftTeamsAPI from "../../../Server/API/MicrosoftTeamsAPI";
+
+const MOCK_TEAMS_CLIENT_ID: string = "11111111-2222-3333-4444-555555555555";
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  return {
+    ...(jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >),
+    MicrosoftTeamsAppClientId: "11111111-2222-3333-4444-555555555555",
+  };
+});
+
+type GetManifestFunction = () => JSONObject;
+
+const getManifest: GetManifestFunction = (): JSONObject => {
+  return (
+    MicrosoftTeamsAPI as unknown as {
+      getTeamsAppManifest: GetManifestFunction;
+    }
+  ).getTeamsAppManifest();
+};
+
+type GetBotFunction = (manifest: JSONObject) => JSONObject;
+
+const getBot: GetBotFunction = (manifest: JSONObject): JSONObject => {
+  const bots: JSONArray = manifest["bots"] as JSONArray;
+  return bots[0] as JSONObject;
+};
+
+type GetResourceSpecificPermissionsFunction = (
+  manifest: JSONObject,
+) => Array<JSONObject>;
+
+const getResourceSpecificPermissions: GetResourceSpecificPermissionsFunction = (
+  manifest: JSONObject,
+): Array<JSONObject> => {
+  const authorization: JSONObject = manifest["authorization"] as JSONObject;
+  const permissions: JSONObject = authorization["permissions"] as JSONObject;
+  return permissions["resourceSpecific"] as Array<JSONObject>;
+};
+
+describe("MicrosoftTeamsAPI.getTeamsAppManifest", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("bot scopes (chat support)", () => {
+    test("declares exactly one bot", () => {
+      const manifest: JSONObject = getManifest();
+      const bots: JSONArray = manifest["bots"] as JSONArray;
+      expect(bots).toHaveLength(1);
+    });
+
+    test("bot scopes contain exactly team, personal and groupChat", () => {
+      const bot: JSONObject = getBot(getManifest());
+      const scopes: Array<string> = bot["scopes"] as Array<string>;
+      expect([...scopes].sort()).toEqual(
+        ["groupChat", "personal", "team"].sort(),
+      );
+    });
+
+    test("bot scopes include groupChat so the bot can be added to group chats", () => {
+      const bot: JSONObject = getBot(getManifest());
+      expect(bot["scopes"] as Array<string>).toContain("groupChat");
+    });
+
+    test("bot scopes include personal so the bot can be added to 1:1 chats", () => {
+      const bot: JSONObject = getBot(getManifest());
+      expect(bot["scopes"] as Array<string>).toContain("personal");
+    });
+
+    test("bot is not notification-only (it must receive conversationUpdate events to capture chats)", () => {
+      const bot: JSONObject = getBot(getManifest());
+      expect(bot["isNotificationOnly"]).toBe(false);
+    });
+  });
+
+  describe("identity", () => {
+    test("bot id equals the Microsoft Teams app client id", () => {
+      const bot: JSONObject = getBot(getManifest());
+      expect(bot["botId"]).toBe(MOCK_TEAMS_CLIENT_ID);
+    });
+
+    test("manifest id equals the Microsoft Teams app client id", () => {
+      const manifest: JSONObject = getManifest();
+      expect(manifest["id"]).toBe(MOCK_TEAMS_CLIENT_ID);
+    });
+
+    test("webApplicationInfo id equals the Microsoft Teams app client id", () => {
+      const manifest: JSONObject = getManifest();
+      const webApplicationInfo: JSONObject = manifest[
+        "webApplicationInfo"
+      ] as JSONObject;
+      expect(webApplicationInfo["id"]).toBe(MOCK_TEAMS_CLIENT_ID);
+    });
+  });
+
+  describe("resource-specific consent permissions", () => {
+    test.each([
+      "ChannelMessage.Send.Group",
+      "ChannelMessage.Read.Group",
+      "Channel.Create.Group",
+      "ChatMessage.Read.Chat",
+      "ChatMember.Read.Chat",
+    ])("includes the %s permission with type Application", (name: string) => {
+      const permissions: Array<JSONObject> =
+        getResourceSpecificPermissions(getManifest());
+      const match: JSONObject | undefined = permissions.find(
+        (permission: JSONObject) => {
+          return permission["name"] === name;
+        },
+      );
+      expect(match).toBeDefined();
+      expect(match!["type"]).toBe("Application");
+    });
+
+    test("does NOT include a ChatMessage.Send.Chat permission (not part of Microsoft's RSC catalog - chat sends go through the bot)", () => {
+      const permissions: Array<JSONObject> =
+        getResourceSpecificPermissions(getManifest());
+      const names: Array<string> = permissions.map((permission: JSONObject) => {
+        return permission["name"] as string;
+      });
+      expect(names).not.toContain("ChatMessage.Send.Chat");
+    });
+
+    test("declares exactly the five expected resource-specific permissions", () => {
+      const permissions: Array<JSONObject> =
+        getResourceSpecificPermissions(getManifest());
+      const names: Array<string> = permissions.map((permission: JSONObject) => {
+        return permission["name"] as string;
+      });
+      expect(names.sort()).toEqual(
+        [
+          "ChannelMessage.Send.Group",
+          "ChannelMessage.Read.Group",
+          "Channel.Create.Group",
+          "ChatMessage.Read.Chat",
+          "ChatMember.Read.Chat",
+        ].sort(),
+      );
+    });
+
+    test("every resource-specific permission is of type Application", () => {
+      const permissions: Array<JSONObject> =
+        getResourceSpecificPermissions(getManifest());
+      for (const permission of permissions) {
+        expect(permission["type"]).toBe("Application");
+      }
+    });
+
+    test("top-level permissions stay identity + messageTeamMembers", () => {
+      const manifest: JSONObject = getManifest();
+      expect(manifest["permissions"]).toEqual([
+        "identity",
+        "messageTeamMembers",
+      ]);
+    });
+  });
+
+  describe("command lists", () => {
+    test("commandLists cover all three scopes (team, groupChat, personal)", () => {
+      const bot: JSONObject = getBot(getManifest());
+      const commandLists: Array<JSONObject> = bot[
+        "commandLists"
+      ] as Array<JSONObject>;
+      const coveredScopes: Set<string> = new Set<string>();
+      for (const commandList of commandLists) {
+        for (const scope of commandList["scopes"] as Array<string>) {
+          coveredScopes.add(scope);
+        }
+      }
+      expect([...coveredScopes].sort()).toEqual(
+        ["groupChat", "personal", "team"].sort(),
+      );
+    });
+
+    test("every commandList scope is a declared bot scope", () => {
+      const bot: JSONObject = getBot(getManifest());
+      const botScopes: Array<string> = bot["scopes"] as Array<string>;
+      const commandLists: Array<JSONObject> = bot[
+        "commandLists"
+      ] as Array<JSONObject>;
+      for (const commandList of commandLists) {
+        for (const scope of commandList["scopes"] as Array<string>) {
+          expect(botScopes).toContain(scope);
+        }
+      }
+    });
+
+    test("commandLists include a help command", () => {
+      const bot: JSONObject = getBot(getManifest());
+      const commandLists: Array<JSONObject> = bot[
+        "commandLists"
+      ] as Array<JSONObject>;
+      const commandTitles: Array<string> = commandLists.flatMap(
+        (commandList: JSONObject) => {
+          return (commandList["commands"] as Array<JSONObject>).map(
+            (command: JSONObject) => {
+              return command["title"] as string;
+            },
+          );
+        },
+      );
+      expect(commandTitles).toContain("help");
+    });
+  });
+
+  describe("manifest schema basics", () => {
+    test("uses manifest schema version 1.23", () => {
+      const manifest: JSONObject = getManifest();
+      expect(manifest["manifestVersion"]).toBe("1.23");
+      expect(manifest["$schema"]).toBe(
+        "https://developer.microsoft.com/json-schemas/teams/v1.23/MicrosoftTeams.schema.json",
+      );
+    });
+
+    test("declares color and outline icons", () => {
+      const manifest: JSONObject = getManifest();
+      const icons: JSONObject = manifest["icons"] as JSONObject;
+      expect(icons["color"]).toBe("color.png");
+      expect(icons["outline"]).toBe("outline.png");
+    });
+  });
+});

package/Tests/Server/API/ProbeAPI.test.ts

@@ -71,6 +71,12 @@ describe("ProbeAPI", () => {
         connectionStatus: true,
         lastAlive: true,
         iconFileId: true,
+        /*
+         * The monitor create form pre-selects the probes that auto-enable on
+         * new monitors, and global probes are not project rows - this endpoint
+         * is the only place the browser can learn the flag for them.
+         */
+        shouldAutoEnableProbeOnNewMonitors: true,
       },
       props: {
         isRoot: true,

package/Tests/Server/API/ZZVerifyChatsAuth.test.ts

@@ -0,0 +1,167 @@
+import { describe, expect, test } from "@jest/globals";
+import express from "express";
+import http from "http";
+import { AddressInfo } from "net";
+
+jest.mock("../../../Server/Services/WorkspaceProjectAuthTokenService", () => {
+  return {
+    __esModule: true,
+    default: {
+      getProjectAuth: jest.fn(async () => {
+        return {
+          miscData: {
+            availableChats: {
+              "19:chat-abc": {
+                id: "19:chat-abc",
+                name: "Jane Doe",
+                chatType: "personal",
+                addedAt: "2026-07-01T00:00:00.000Z",
+              },
+              "19:chat-def": {
+                id: "19:chat-def",
+                name: "Alice, Bob + 2 more",
+                chatType: "group",
+                addedAt: "2026-07-02T00:00:00.000Z",
+              },
+            },
+          },
+        };
+      }),
+    },
+  };
+});
+
+jest.mock("../../../Server/Services/ProjectService", () => {
+  return {
+    __esModule: true,
+    default: {
+      updateLastActive: jest.fn(async () => {
+        return undefined;
+      }),
+      getCurrentPlan: jest.fn(async () => {
+        return { plan: null, isSubscriptionUnpaid: false };
+      }),
+      getRequireSsoForLogin: jest.fn(async () => {
+        return true;
+      }),
+    },
+  };
+});
+
+interface HttpProbeResult {
+  status: number;
+  body: unknown;
+}
+
+/*
+ * The jest test environment is jsdom, which does not expose a global fetch, so
+ * this probe talks to the server with Node's http client. Everything runs
+ * inside the caller's try/finally so the server is always closed - a leaked
+ * listener keeps the event loop alive and hangs the whole `jest` run at exit.
+ */
+type HttpGetJsonFunction = (data: {
+  port: number;
+  path: string;
+  headers: http.OutgoingHttpHeaders;
+}) => Promise<HttpProbeResult>;
+
+const httpGetJson: HttpGetJsonFunction = (data: {
+  port: number;
+  path: string;
+  headers: http.OutgoingHttpHeaders;
+}): Promise<HttpProbeResult> => {
+  return new Promise<HttpProbeResult>(
+    (
+      resolve: (result: HttpProbeResult) => void,
+      reject: (error: Error) => void,
+    ) => {
+      const request: http.ClientRequest = http.request(
+        {
+          host: "127.0.0.1",
+          port: data.port,
+          path: data.path,
+          method: "GET",
+          headers: data.headers,
+        },
+        (response: http.IncomingMessage) => {
+          const chunks: Array<Buffer> = [];
+
+          response.on("data", (chunk: Buffer) => {
+            chunks.push(chunk);
+          });
+
+          response.on("end", () => {
+            const raw: string = Buffer.concat(chunks).toString("utf8");
+
+            let parsed: unknown = null;
+            try {
+              parsed = raw ? JSON.parse(raw) : null;
+            } catch {
+              parsed = raw;
+            }
+
+            resolve({
+              status: response.statusCode || 0,
+              body: parsed,
+            });
+          });
+        },
+      );
+
+      request.on("error", (error: Error) => {
+        return reject(error);
+      });
+
+      request.end();
+    },
+  );
+};
+
+describe("ANON ACCESS PROBE /microsoft-teams/chats", () => {
+  test("unauthenticated GET with only a tenantid header", async () => {
+    const MicrosoftTeamsAPI: any = (
+      await import("../../../Server/API/MicrosoftTeamsAPI")
+    ).default;
+
+    const app: express.Express = express();
+    app.use("/api", new MicrosoftTeamsAPI().getRouter());
+
+    const server: http.Server = http.createServer(app);
+    await new Promise<void>((resolve: () => void) => {
+      server.listen(0, resolve);
+    });
+
+    try {
+      const port: number = (server.address() as AddressInfo).port;
+
+      const result: HttpProbeResult = await httpGetJson({
+        port,
+        path: "/api/microsoft-teams/chats",
+        headers: {
+          tenantid: "6f4e4b2c-1111-4c2a-9e3d-abcdefabcdef",
+        },
+      });
+
+      /*
+       * The hardening in this branch requires an authenticated project member:
+       * getUserMiddleware admits unauthenticated requests as Public, so the
+       * route must reject one carrying only a tenantid header. A 200 here would
+       * mean the captured chat list leaks to anonymous callers - the exact
+       * regression this probe guards against.
+       */
+      expect(result.status).toBeGreaterThanOrEqual(400);
+      expect(result.status).toBeLessThan(500);
+
+      const serializedBody: string = JSON.stringify(result.body);
+      expect(serializedBody).not.toContain("Jane Doe");
+      expect(serializedBody).not.toContain("19:chat-abc");
+      expect(serializedBody).not.toContain("19:chat-def");
+    } finally {
+      await new Promise<void>((resolve: () => void) => {
+        server.close(() => {
+          return resolve();
+        });
+      });
+    }
+  }, 30000);
+});

package/Tests/Server/Services/AddHotQueryIndexesMigration.test.ts

@@ -0,0 +1,255 @@
+import Incident from "../../../Models/DatabaseModels/Incident";
+import IncidentEpisode from "../../../Models/DatabaseModels/IncidentEpisode";
+import IncidentEpisodePublicNote from "../../../Models/DatabaseModels/IncidentEpisodePublicNote";
+import IncidentEpisodeStateTimeline from "../../../Models/DatabaseModels/IncidentEpisodeStateTimeline";
+import IncidentPublicNote from "../../../Models/DatabaseModels/IncidentPublicNote";
+import IncidentStateTimeline from "../../../Models/DatabaseModels/IncidentStateTimeline";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import OnCallDutyPolicyExecutionLog from "../../../Models/DatabaseModels/OnCallDutyPolicyExecutionLog";
+import ScheduledMaintenance from "../../../Models/DatabaseModels/ScheduledMaintenance";
+import ScheduledMaintenancePublicNote from "../../../Models/DatabaseModels/ScheduledMaintenancePublicNote";
+import ScheduledMaintenanceStateTimeline from "../../../Models/DatabaseModels/ScheduledMaintenanceStateTimeline";
+import StatusPageAnnouncement from "../../../Models/DatabaseModels/StatusPageAnnouncement";
+import { AddHotQueryIndexes1785140242697 } from "../../../Server/Infrastructure/Postgres/SchemaMigrations/1785140242697-AddHotQueryIndexes";
+import SchemaMigrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { QueryRunner, getMetadataArgsStorage } from "typeorm";
+import type { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The 13 columns below are the filter columns of ~13 EVERY_MINUTE worker
+ * queries (the on-call executor crons scan OnCallDutyPolicyExecutionLog.status,
+ * the every-30s heartbeat crons branch on Monitor.monitorType, and the 11
+ * subscriberNotificationStatus* columns map 1:1 to the EVERY_MINUTE
+ * SendNotificationToSubscribers jobs that poll ever-growing tables for
+ * usually-zero Pending rows). Before AddHotQueryIndexes1785140242697 every one
+ * of those queries was a full-table seq scan.
+ *
+ * These tests pin the three pieces that must all hold for the scans to stay
+ * gone — a regression in ANY one silently reintroduces them:
+ *   1. the @Index() decorator on each entity property (keeps future
+ *      schema:generate runs from emitting a DROP INDEX as "drift"),
+ *   2. the migration's SQL contract: up() creates exactly these 13 indexes
+ *      and nothing else (no ALTER TABLE drift statements from a regenerated
+ *      migration), down() drops exactly the indexes up() created,
+ *   3. the migration's registration in SchemaMigrations/Index.ts (an
+ *      unregistered migration is dead code and never runs on boot).
+ *
+ * Pure metadata/mocks — no Postgres connection anywhere.
+ */
+
+type ModelClass = { new (): unknown };
+
+// [entity class, table name (=== class name for all of these), indexed column]
+const HOT_INDEX_PAIRS: Array<[ModelClass, string, string]> = [
+  [Monitor, "Monitor", "monitorType"],
+  [OnCallDutyPolicyExecutionLog, "OnCallDutyPolicyExecutionLog", "status"],
+  [
+    IncidentStateTimeline,
+    "IncidentStateTimeline",
+    "subscriberNotificationStatus",
+  ],
+  [Incident, "Incident", "subscriberNotificationStatusOnIncidentCreated"],
+  [Incident, "Incident", "subscriberNotificationStatusOnPostmortemPublished"],
+  [
+    IncidentPublicNote,
+    "IncidentPublicNote",
+    "subscriberNotificationStatusOnNoteCreated",
+  ],
+  [
+    IncidentEpisode,
+    "IncidentEpisode",
+    "subscriberNotificationStatusOnEpisodeCreated",
+  ],
+  [
+    IncidentEpisodeStateTimeline,
+    "IncidentEpisodeStateTimeline",
+    "subscriberNotificationStatus",
+  ],
+  [
+    IncidentEpisodePublicNote,
+    "IncidentEpisodePublicNote",
+    "subscriberNotificationStatusOnNoteCreated",
+  ],
+  [
+    ScheduledMaintenance,
+    "ScheduledMaintenance",
+    "subscriberNotificationStatusOnEventScheduled",
+  ],
+  [
+    ScheduledMaintenanceStateTimeline,
+    "ScheduledMaintenanceStateTimeline",
+    "subscriberNotificationStatus",
+  ],
+  [
+    ScheduledMaintenancePublicNote,
+    "ScheduledMaintenancePublicNote",
+    "subscriberNotificationStatusOnNoteCreated",
+  ],
+  [
+    StatusPageAnnouncement,
+    "StatusPageAnnouncement",
+    "subscriberNotificationStatus",
+  ],
+];
+
+/*
+ * IndexMetadataArgs.columns is either an array of property names (property-
+ * level @Index()) or a function over the entity's properties map (class-level
+ * @Index((o) => [o.a, o.b])). Resolve both to plain property-name arrays; the
+ * function form is fed a proxy whose every property reads as its own name,
+ * which is exactly how TypeORM's propertiesMap behaves for flat columns.
+ */
+function resolveIndexColumns(
+  columns: IndexMetadataArgs["columns"],
+): Array<string> {
+  if (!columns) {
+    return [];
+  }
+  if (Array.isArray(columns)) {
+    return columns.map(String);
+  }
+  const propertiesMap: Record<string, string> = new Proxy(
+    {},
+    {
+      get: (_target: Record<string, string>, property: string | symbol) => {
+        return String(property);
+      },
+    },
+  );
+  const resolved: Array<unknown> | { [key: string]: number } =
+    columns(propertiesMap);
+  if (Array.isArray(resolved)) {
+    return resolved.map(String);
+  }
+  return Object.keys(resolved);
+}
+
+interface CreateIndexStatement {
+  indexName: string;
+  tableName: string;
+  columnName: string;
+}
+
+const CREATE_INDEX_REGEX: RegExp =
+  /^CREATE INDEX "([^"]+)" ON "([^"]+)" \("([^"]+)"\)\s*$/;
+const DROP_INDEX_REGEX: RegExp = /^DROP INDEX "public"\."([^"]+)"$/;
+
+function makeQueryRunner(): { runner: QueryRunner; query: jest.Mock } {
+  const query: jest.Mock = jest.fn().mockResolvedValue(undefined);
+  return { runner: { query } as unknown as QueryRunner, query };
+}
+
+function executedSql(query: jest.Mock): Array<string> {
+  return query.mock.calls.map((call: Array<unknown>) => {
+    return String(call[0]);
+  });
+}
+
+describe("AddHotQueryIndexes: entity @Index() decorators", () => {
+  test.each(
+    HOT_INDEX_PAIRS.map(
+      ([model, table, column]: [ModelClass, string, string]) => {
+        return [table, column, model] as [string, string, ModelClass];
+      },
+    ),
+  )(
+    "%s.%s has a single-column index decorator",
+    (_table: string, column: string, model: ModelClass) => {
+      const singleColumnIndexes: Array<string> = getMetadataArgsStorage()
+        .indices.filter((index: IndexMetadataArgs) => {
+          return index.target === model;
+        })
+        .map((index: IndexMetadataArgs) => {
+          return resolveIndexColumns(index.columns);
+        })
+        .filter((columns: Array<string>) => {
+          return columns.length === 1;
+        })
+        .map((columns: Array<string>) => {
+          return columns[0] as string;
+        });
+
+      expect(singleColumnIndexes).toContain(column);
+    },
+  );
+});
+
+describe("AddHotQueryIndexes1785140242697 migration SQL contract", () => {
+  const migration: AddHotQueryIndexes1785140242697 =
+    new AddHotQueryIndexes1785140242697();
+
+  test("up() issues exactly 13 CREATE INDEX statements covering exactly the 13 hot columns — and nothing else", async () => {
+    const { runner, query } = makeQueryRunner();
+    await migration.up(runner);
+
+    const statements: Array<string> = executedSql(query);
+    expect(statements).toHaveLength(13);
+
+    /*
+     * A regenerated migration on a drifted schema would interleave ALTER
+     * TABLE / DROP statements with the index creates; none may sneak in.
+     */
+    for (const sql of statements) {
+      expect(sql).not.toContain("ALTER TABLE");
+      expect(sql).not.toContain("DROP");
+      expect(sql).toMatch(CREATE_INDEX_REGEX);
+    }
+
+    const created: Array<CreateIndexStatement> = statements.map(
+      (sql: string) => {
+        const match: RegExpMatchArray = sql.match(
+          CREATE_INDEX_REGEX,
+        ) as RegExpMatchArray;
+        return {
+          indexName: match[1] as string,
+          tableName: match[2] as string,
+          columnName: match[3] as string,
+        };
+      },
+    );
+
+    const createdPairs: Array<string> = created
+      .map((statement: CreateIndexStatement) => {
+        return `"${statement.tableName}"."${statement.columnName}"`;
+      })
+      .sort();
+    const expectedPairs: Array<string> = HOT_INDEX_PAIRS.map(
+      ([, table, column]: [ModelClass, string, string]) => {
+        return `"${table}"."${column}"`;
+      },
+    ).sort();
+
+    expect(createdPairs).toEqual(expectedPairs);
+  });
+
+  test("down() drops exactly the 13 indexes up() created", async () => {
+    const upRunner: { runner: QueryRunner; query: jest.Mock } =
+      makeQueryRunner();
+    await migration.up(upRunner.runner);
+    const createdNames: Array<string> = executedSql(upRunner.query).map(
+      (sql: string) => {
+        return (sql.match(CREATE_INDEX_REGEX) as RegExpMatchArray)[1] as string;
+      },
+    );
+
+    const downRunner: { runner: QueryRunner; query: jest.Mock } =
+      makeQueryRunner();
+    await migration.down(downRunner.runner);
+    const statements: Array<string> = executedSql(downRunner.query);
+    expect(statements).toHaveLength(13);
+
+    const droppedNames: Array<string> = statements.map((sql: string) => {
+      expect(sql).toMatch(DROP_INDEX_REGEX);
+      return (sql.match(DROP_INDEX_REGEX) as RegExpMatchArray)[1] as string;
+    });
+
+    expect([...droppedNames].sort()).toEqual([...createdNames].sort());
+  });
+});
+
+describe("AddHotQueryIndexes1785140242697 registration", () => {
+  test("is registered in SchemaMigrations/Index.ts so it actually runs on boot", () => {
+    expect(SchemaMigrations).toContain(AddHotQueryIndexes1785140242697);
+  });
+});