@oneuptime/common 11.7.1 → 11.7.2

package/Tests/Server/Utils/AI/Insights/InsightFixRouting.test.ts

@@ -185,7 +185,7 @@ describe("InsightFixRouting.routeInsightFix", () => {
     const create: jest.SpyInstance = jest
       .spyOn(TelemetryExceptionService, "createCodeFixRunForException")
       .mockResolvedValue({ id: fixRunId } as unknown as AIRun);
-    jest.spyOn(AIRunService, "updateOneById").mockResolvedValue(undefined);
+    jest.spyOn(AIRunService, "updateOneById").mockResolvedValue(1);
 
     const explicitlyOn: InsightFixRoutingResult =
       await InsightFixRouting.routeInsightFix({
@@ -303,7 +303,7 @@ describe("InsightFixRouting.routeInsightFix", () => {
       .mockResolvedValue({ id: fixRunId } as unknown as AIRun);
     const stamp: jest.SpyInstance = jest
       .spyOn(AIRunService, "updateOneById")
-      .mockResolvedValue(undefined);
+      .mockResolvedValue(1);
 
     const result: InsightFixRoutingResult =
       await InsightFixRouting.routeInsightFix({
@@ -339,7 +339,7 @@ describe("InsightFixRouting.routeInsightFix", () => {
       .mockResolvedValue({ id: fixRunId } as unknown as AIRun);
     const stamp: jest.SpyInstance = jest
       .spyOn(AIRunService, "updateOneById")
-      .mockResolvedValue(undefined);
+      .mockResolvedValue(1);
 
     const result: InsightFixRoutingResult =
       await InsightFixRouting.routeInsightFix({
@@ -382,7 +382,7 @@ describe("InsightFixRouting.routeInsightFix", () => {
     const createFromFindings: jest.SpyInstance = jest
       .spyOn(FixPerformanceTaskTrigger, "createPerformanceFixTaskFromFindings")
       .mockResolvedValue({ id: fixRunId } as unknown as AIRun);
-    jest.spyOn(AIRunService, "updateOneById").mockResolvedValue(undefined);
+    jest.spyOn(AIRunService, "updateOneById").mockResolvedValue(1);
 
     await InsightFixRouting.routeInsightFix({
       insight: makeLatencyInsight({ traceId: undefined }),

package/Tests/Server/Utils/AI/Insights/InsightScanner.test.ts

@@ -289,7 +289,7 @@ describe("InsightScanner — routing newly created insights", () => {
     jest.spyOn(AIInsightService, "findBy").mockResolvedValue([]);
     updateOneById = jest
       .spyOn(AIInsightService, "updateOneById")
-      .mockResolvedValue(undefined);
+      .mockResolvedValue(1);
     routeInsightFix = jest
       .spyOn(InsightFixRouting, "routeInsightFix")
       .mockResolvedValue({});
@@ -477,7 +477,7 @@ describe("InsightScanner — the self-heal sweep for insights stranded in Detect
       });
     updateOneById = jest
       .spyOn(AIInsightService, "updateOneById")
-      .mockResolvedValue(undefined);
+      .mockResolvedValue(1);
     routeInsightFix = jest
       .spyOn(InsightFixRouting, "routeInsightFix")
       .mockResolvedValue({});

package/Tests/Server/Utils/AI/Insights/InsightStore.test.ts

@@ -74,9 +74,7 @@ function mockCreate(): jest.SpyInstance {
 }
 
 function mockUpdateOneById(): jest.SpyInstance {
-  return jest
-    .spyOn(AIInsightService, "updateOneById")
-    .mockResolvedValue(undefined);
+  return jest.spyOn(AIInsightService, "updateOneById").mockResolvedValue(1);
 }
 
 describe("InsightStore.upsertCandidates — dedupe matrix", () => {

package/Tests/Server/Utils/AI/Insights/InsightStoreHardening.test.ts

@@ -83,9 +83,7 @@ function mockFindOneBy(existing: AIInsight | null): jest.SpyInstance {
 }
 
 function mockUpdateOneById(): jest.SpyInstance {
-  return jest
-    .spyOn(AIInsightService, "updateOneById")
-    .mockResolvedValue(undefined);
+  return jest.spyOn(AIInsightService, "updateOneById").mockResolvedValue(1);
 }
 
 describe("InsightStore — column-length clamps", () => {

package/Tests/Server/Utils/AI/Insights/InsightTriage.test.ts

@@ -160,7 +160,7 @@ describe("InsightTriage.enqueueInsightTriage", () => {
       .mockResolvedValue(triageRunId);
     const persist: jest.SpyInstance = jest
       .spyOn(AIInsightService, "updateOneById")
-      .mockResolvedValue(undefined);
+      .mockResolvedValue(1);
 
     const result: InsightTriageResult =
       await InsightTriage.enqueueInsightTriage({ insight: makeInsight() });

package/Tests/Server/Utils/AI/Insights/InsightTriageRunner.test.ts

@@ -194,7 +194,7 @@ describe("InsightTriageRunner.executeTriage", () => {
       .mockResolvedValue(makeInsight());
     const persist: jest.SpyInstance = jest
       .spyOn(AIInsightService, "updateOneById")
-      .mockResolvedValue(undefined);
+      .mockResolvedValue(1);
     const incidentFeed: jest.SpyInstance = jest
       .spyOn(IncidentFeedService, "createIncidentFeedItem")
       .mockResolvedValue(undefined);
@@ -258,7 +258,7 @@ describe("InsightTriageRunner.executeTriage", () => {
       .mockResolvedValue(makeInsight({ telemetryExceptionId }));
     const persistInsight: jest.SpyInstance = jest
       .spyOn(AIInsightService, "updateOneById")
-      .mockResolvedValue(undefined);
+      .mockResolvedValue(1);
     const flipStatus: jest.SpyInstance = jest
       .spyOn(AIInsightService, "updateOneBy")
       .mockResolvedValue(undefined as never);
@@ -342,7 +342,7 @@ describe("InsightTriageRunner.executeTriage", () => {
       );
     const persistInsight: jest.SpyInstance = jest
       .spyOn(AIInsightService, "updateOneById")
-      .mockResolvedValue(undefined);
+      .mockResolvedValue(1);
     const flipStatus: jest.SpyInstance = jest
       .spyOn(AIInsightService, "updateOneBy")
       .mockResolvedValue(undefined as never);
@@ -389,7 +389,7 @@ describe("InsightTriageRunner.executeTriage", () => {
     jest
       .spyOn(AIInsightService, "findOneById")
       .mockResolvedValue(makeInsight({ telemetryExceptionId }));
-    jest.spyOn(AIInsightService, "updateOneById").mockResolvedValue(undefined);
+    jest.spyOn(AIInsightService, "updateOneById").mockResolvedValue(1);
     const exceptionWrites: jest.SpyInstance = jest
       .spyOn(TelemetryExceptionService, "updateOneById")
       .mockResolvedValue(undefined as never);
@@ -432,7 +432,7 @@ describe("InsightTriageRunner.executeTriage", () => {
     jest
       .spyOn(AIInsightService, "findOneById")
       .mockResolvedValue(makeInsight({ telemetryExceptionId }));
-    jest.spyOn(AIInsightService, "updateOneById").mockResolvedValue(undefined);
+    jest.spyOn(AIInsightService, "updateOneById").mockResolvedValue(1);
     const exceptionWrites: jest.SpyInstance = jest
       .spyOn(TelemetryExceptionService, "updateOneById")
       .mockResolvedValue(undefined as never);

package/Tests/Server/Utils/Alert/AlertPrivacyFilter.test.ts

@@ -0,0 +1,187 @@
+import {
+  applyAlertRelatedRecordPrivacyFilter,
+  applyAlertSelfPrivacyFilter,
+  getAlertRelatedRecordPrivacyRaw,
+  getAlertSelfPrivacyRaw,
+  shouldBypassAlertPrivacy,
+} from "../../../../Server/Utils/Alert/AlertPrivacyFilter";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+import { FindOperator } from "typeorm";
+
+/*
+ * AlertPrivacyFilter is the alert-side twin of IncidentPrivacyFilter: private
+ * alerts are visible to owners (directly or via team), and to project
+ * owners/admins/root. Each branch is pinned against the SQL actually emitted.
+ */
+
+const userId: ObjectID = ObjectID.generate();
+const tenantId: ObjectID = ObjectID.generate();
+
+const propsWithProjectPermission: (
+  permission: Permission,
+) => DatabaseCommonInteractionProps = (
+  permission: Permission,
+): DatabaseCommonInteractionProps => {
+  const userPermission: UserPermission = {
+    _type: "UserPermission",
+    permission: permission,
+    labelIds: [],
+  };
+
+  const tenantPermission: UserTenantAccessPermission = {
+    _type: "UserTenantAccessPermission",
+    projectId: tenantId,
+    permissions: [userPermission],
+  };
+
+  return {
+    userId: userId,
+    tenantId: tenantId,
+    userTenantAccessPermission: {
+      [tenantId.toString()]: tenantPermission,
+    },
+  };
+};
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+type RawParts = { sql: string; params: Record<string, string> };
+
+const rawParts: (clause: unknown) => RawParts = (clause: unknown): RawParts => {
+  const operator: any = clause as any;
+
+  return {
+    sql: String(operator._getSql("COLUMN")),
+    params: (operator._objectLiteralParameters || {}) as Record<string, string>,
+  };
+};
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+describe("shouldBypassAlertPrivacy", () => {
+  test("root, master-admin, project owner and project admin bypass", () => {
+    expect(shouldBypassAlertPrivacy({ isRoot: true })).toBe(true);
+    expect(shouldBypassAlertPrivacy({ isMasterAdmin: true })).toBe(true);
+    expect(
+      shouldBypassAlertPrivacy(
+        propsWithProjectPermission(Permission.ProjectOwner),
+      ),
+    ).toBe(true);
+    expect(
+      shouldBypassAlertPrivacy(
+        propsWithProjectPermission(Permission.ProjectAdmin),
+      ),
+    ).toBe(true);
+  });
+
+  test("an ordinary member, or a permission under another tenant, does not bypass", () => {
+    expect(
+      shouldBypassAlertPrivacy(
+        propsWithProjectPermission(Permission.ProjectMember),
+      ),
+    ).toBe(false);
+
+    const wrongTenant: DatabaseCommonInteractionProps =
+      propsWithProjectPermission(Permission.ProjectOwner);
+    wrongTenant.tenantId = ObjectID.generate();
+    expect(shouldBypassAlertPrivacy(wrongTenant)).toBe(false);
+
+    expect(shouldBypassAlertPrivacy({})).toBe(false);
+  });
+});
+
+describe("getAlertSelfPrivacyRaw", () => {
+  test("bypassing callers get no clause", () => {
+    expect(getAlertSelfPrivacyRaw({ isRoot: true })).toBeUndefined();
+  });
+
+  test("anonymous callers only see non-private alerts, no params bound", () => {
+    const { sql, params }: RawParts = rawParts(getAlertSelfPrivacyRaw({}));
+
+    expect(sql).toContain("COLUMN IS NULL OR COLUMN = FALSE");
+    expect(sql).not.toContain("AlertOwnerUser");
+    expect(Object.keys(params)).toHaveLength(0);
+  });
+
+  test("a user also sees alerts they own directly or via a team, bound to their id", () => {
+    const { sql, params }: RawParts = rawParts(
+      getAlertSelfPrivacyRaw({ userId }),
+    );
+
+    expect(sql).toContain("AlertOwnerUser");
+    expect(sql).toContain("AlertOwnerTeam");
+    expect(sql).toContain("TeamMember");
+    expect(sql).toContain(`aou."deletedAt" IS NULL`);
+    expect(Object.values(params)).toEqual([userId.toString()]);
+  });
+
+  test("fresh parameter name per call", () => {
+    const first: RawParts = rawParts(getAlertSelfPrivacyRaw({ userId }));
+    const second: RawParts = rawParts(getAlertSelfPrivacyRaw({ userId }));
+    expect(Object.keys(first.params)).not.toEqual(Object.keys(second.params));
+  });
+});
+
+describe("getAlertRelatedRecordPrivacyRaw", () => {
+  test("anonymous callers are scoped to child rows of non-private alerts", () => {
+    const { sql, params }: RawParts = rawParts(
+      getAlertRelatedRecordPrivacyRaw({}),
+    );
+
+    expect(sql).toContain(`FROM "Alert" a`);
+    expect(sql).toContain(`a."isPrivate" IS NULL OR a."isPrivate" = FALSE`);
+    expect(Object.keys(params)).toHaveLength(0);
+  });
+
+  test("a user's child rows also include alerts they own", () => {
+    const { sql, params }: RawParts = rawParts(
+      getAlertRelatedRecordPrivacyRaw({ userId }),
+    );
+
+    expect(sql).toContain("AlertOwnerUser");
+    expect(Object.values(params)).toEqual([userId.toString()]);
+  });
+});
+
+describe("applyAlertSelfPrivacyFilter / applyAlertRelatedRecordPrivacyFilter", () => {
+  test("bypassing callers get their query back untouched", () => {
+    const query: { isPrivate?: unknown } = {};
+    expect(applyAlertSelfPrivacyFilter(query, { isRoot: true })).toBe(query);
+  });
+
+  test("self filter sets isPrivate and keeps other keys", () => {
+    const projectId: ObjectID = ObjectID.generate();
+    const result: { projectId: ObjectID; isPrivate?: unknown } =
+      applyAlertSelfPrivacyFilter({ projectId }, { userId });
+
+    expect(result.projectId).toBe(projectId);
+    expect(result.isPrivate).toBeInstanceOf(FindOperator);
+  });
+
+  test("self filter ANDs an existing isPrivate value", () => {
+    const result: { isPrivate?: unknown } = applyAlertSelfPrivacyFilter(
+      { isPrivate: false },
+      { userId },
+    );
+    /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+    expect(String((result.isPrivate as any)._type)).toBe("and");
+  });
+
+  test("related filter builds { alertId: clause } and ANDs an existing alertId", () => {
+    const created: { alertId?: unknown } = applyAlertRelatedRecordPrivacyFilter(
+      undefined as unknown as { alertId?: unknown },
+      { userId },
+    );
+    expect(created.alertId).toBeInstanceOf(FindOperator);
+
+    const alertId: ObjectID = ObjectID.generate();
+    const combined: { alertId?: unknown } =
+      applyAlertRelatedRecordPrivacyFilter({ alertId }, { userId });
+    /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+    expect(String((combined.alertId as any)._type)).toBe("and");
+  });
+});

package/Tests/Server/Utils/AlertEpisode/AlertEpisodePrivacyFilter.test.ts

@@ -0,0 +1,170 @@
+import {
+  applyAlertEpisodeRelatedRecordPrivacyFilter,
+  applyAlertEpisodeSelfPrivacyFilter,
+  getAlertEpisodeRelatedRecordPrivacyRaw,
+  getAlertEpisodeSelfPrivacyRaw,
+  shouldBypassAlertEpisodePrivacy,
+} from "../../../../Server/Utils/AlertEpisode/AlertEpisodePrivacyFilter";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+import { FindOperator } from "typeorm";
+
+/*
+ * Alert-episode privacy is the alert-side twin of incident-episode privacy.
+ * The emitted SQL is pinned so a wrong table/column or a dropped soft-delete
+ * guard is caught.
+ */
+
+const userId: ObjectID = ObjectID.generate();
+const tenantId: ObjectID = ObjectID.generate();
+
+const propsWithProjectPermission: (
+  permission: Permission,
+) => DatabaseCommonInteractionProps = (
+  permission: Permission,
+): DatabaseCommonInteractionProps => {
+  const userPermission: UserPermission = {
+    _type: "UserPermission",
+    permission: permission,
+    labelIds: [],
+  };
+
+  const tenantPermission: UserTenantAccessPermission = {
+    _type: "UserTenantAccessPermission",
+    projectId: tenantId,
+    permissions: [userPermission],
+  };
+
+  return {
+    userId: userId,
+    tenantId: tenantId,
+    userTenantAccessPermission: {
+      [tenantId.toString()]: tenantPermission,
+    },
+  };
+};
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+type RawParts = { sql: string; params: Record<string, string> };
+
+const rawParts: (clause: unknown) => RawParts = (clause: unknown): RawParts => {
+  const operator: any = clause as any;
+
+  return {
+    sql: String(operator._getSql("COLUMN")),
+    params: (operator._objectLiteralParameters || {}) as Record<string, string>,
+  };
+};
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+describe("shouldBypassAlertEpisodePrivacy", () => {
+  test("root, master-admin, owner and admin bypass; member does not", () => {
+    expect(shouldBypassAlertEpisodePrivacy({ isRoot: true })).toBe(true);
+    expect(shouldBypassAlertEpisodePrivacy({ isMasterAdmin: true })).toBe(true);
+    expect(
+      shouldBypassAlertEpisodePrivacy(
+        propsWithProjectPermission(Permission.ProjectAdmin),
+      ),
+    ).toBe(true);
+    expect(
+      shouldBypassAlertEpisodePrivacy(
+        propsWithProjectPermission(Permission.ProjectMember),
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("getAlertEpisodeSelfPrivacyRaw", () => {
+  test("bypassing callers get no clause", () => {
+    expect(getAlertEpisodeSelfPrivacyRaw({ isRoot: true })).toBeUndefined();
+  });
+
+  test("anonymous callers only see non-private episodes, no params bound", () => {
+    const { sql, params }: RawParts = rawParts(
+      getAlertEpisodeSelfPrivacyRaw({}),
+    );
+
+    expect(sql).toContain("COLUMN IS NULL OR COLUMN = FALSE");
+    expect(sql).not.toContain("AlertEpisodeOwnerUser");
+    expect(Object.keys(params)).toHaveLength(0);
+  });
+
+  test("a user also sees episodes they own, bound to their id", () => {
+    const { sql, params }: RawParts = rawParts(
+      getAlertEpisodeSelfPrivacyRaw({ userId }),
+    );
+
+    expect(sql).toContain("AlertEpisodeOwnerUser");
+    expect(sql).toContain("AlertEpisodeOwnerTeam");
+    expect(sql).toContain(`aeou."deletedAt" IS NULL`);
+    expect(Object.values(params)).toEqual([userId.toString()]);
+  });
+
+  test("fresh parameter name per call", () => {
+    const first: RawParts = rawParts(getAlertEpisodeSelfPrivacyRaw({ userId }));
+    const second: RawParts = rawParts(
+      getAlertEpisodeSelfPrivacyRaw({ userId }),
+    );
+    expect(Object.keys(first.params)).not.toEqual(Object.keys(second.params));
+  });
+});
+
+describe("getAlertEpisodeRelatedRecordPrivacyRaw", () => {
+  test("anonymous callers are scoped to child rows of non-private episodes", () => {
+    const { sql }: RawParts = rawParts(
+      getAlertEpisodeRelatedRecordPrivacyRaw({}),
+    );
+
+    expect(sql).toContain(`FROM "AlertEpisode" ae`);
+    expect(sql).toContain(`ae."isPrivate" IS NULL OR ae."isPrivate" = FALSE`);
+  });
+
+  test("a user's child rows include episodes they own", () => {
+    const { sql, params }: RawParts = rawParts(
+      getAlertEpisodeRelatedRecordPrivacyRaw({ userId }),
+    );
+
+    expect(sql).toContain("AlertEpisodeOwnerUser");
+    expect(Object.values(params)).toEqual([userId.toString()]);
+  });
+});
+
+describe("apply* alert-episode filters", () => {
+  test("bypassing callers get their query back untouched", () => {
+    const query: { isPrivate?: unknown } = {};
+    expect(applyAlertEpisodeSelfPrivacyFilter(query, { isRoot: true })).toBe(
+      query,
+    );
+  });
+
+  test("self filter sets isPrivate; related filter builds { alertEpisodeId }", () => {
+    const self: { isPrivate?: unknown } = applyAlertEpisodeSelfPrivacyFilter(
+      {},
+      { userId },
+    );
+    expect(self.isPrivate).toBeInstanceOf(FindOperator);
+
+    const related: { alertEpisodeId?: unknown } =
+      applyAlertEpisodeRelatedRecordPrivacyFilter(
+        undefined as unknown as { alertEpisodeId?: unknown },
+        { userId },
+      );
+    expect(related.alertEpisodeId).toBeInstanceOf(FindOperator);
+  });
+
+  test("an existing alertEpisodeId filter is ANDed, not replaced", () => {
+    const alertEpisodeId: ObjectID = ObjectID.generate();
+    const combined: { alertEpisodeId?: unknown } =
+      applyAlertEpisodeRelatedRecordPrivacyFilter(
+        { alertEpisodeId },
+        { userId },
+      );
+    /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+    expect(String((combined.alertEpisodeId as any)._type)).toBe("and");
+  });
+});

package/Tests/Server/Utils/Database/PostgresErrorTranslator.test.ts

@@ -0,0 +1,125 @@
+import PostgresErrorTranslator from "../../../../Server/Utils/Database/PostgresErrorTranslator";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import Exception from "../../../../Types/Exception/Exception";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test: TypeORM's QueryFailedError is not an Exception, so it
+ * used to fall through StartServer's generic handler and reach the client as a
+ * bare 500 "Server Error" — which is exactly what deleting a project hit when
+ * another project's MonitorStatusTimeline rows still referenced its statuses.
+ *
+ * The translator turns the actionable Postgres failures into a
+ * BadDataException (400) and leaves everything else untouched.
+ */
+
+type FakeQueryFailedError = {
+  message: string;
+  code?: string | undefined;
+  table?: string | undefined;
+  detail?: string | undefined;
+  driverError?: unknown;
+};
+
+const foreignKeyDeleteError: () => FakeQueryFailedError =
+  (): FakeQueryFailedError => {
+    return {
+      message:
+        'update or delete on table "MonitorStatus" violates foreign key constraint "FK_574feb4161c5216c2c7ee0faaf8" on table "MonitorStatusTimeline"',
+      code: "23503",
+      table: "MonitorStatusTimeline",
+      detail:
+        'Key (_id)=(cfc2f04f-79cb-4344-8c54-dafe5e3a290c) is still referenced from table "MonitorStatusTimeline".',
+    };
+  };
+
+describe("PostgresErrorTranslator", () => {
+  describe("foreign key violation on delete", () => {
+    it("translates to a BadDataException naming the blocking table", () => {
+      const translated: unknown = PostgresErrorTranslator.translate(
+        foreignKeyDeleteError(),
+      );
+
+      expect(translated).toBeInstanceOf(BadDataException);
+      expect((translated as Exception).message).toBe(
+        "This item cannot be deleted because Monitor Status Timeline records still reference it. Please delete those records first, and then try again.",
+      );
+    });
+
+    it("reads the pg fields off driverError when the wrapper has no code", () => {
+      const translated: unknown = PostgresErrorTranslator.translate({
+        message: "wrapped",
+        driverError: foreignKeyDeleteError(),
+      });
+
+      expect(translated).toBeInstanceOf(BadDataException);
+      expect((translated as Exception).message).toContain(
+        "Monitor Status Timeline",
+      );
+    });
+
+    it("does not leak the offending row id into the message", () => {
+      const translated: unknown = PostgresErrorTranslator.translate(
+        foreignKeyDeleteError(),
+      );
+
+      expect((translated as Exception).message).not.toContain(
+        "cfc2f04f-79cb-4344-8c54-dafe5e3a290c",
+      );
+    });
+  });
+
+  describe("foreign key violation on insert or update", () => {
+    it("translates to a BadDataException naming the missing record", () => {
+      const translated: unknown = PostgresErrorTranslator.translate({
+        message: "insert violates foreign key constraint",
+        code: "23503",
+        table: "MonitorStatusTimeline",
+        detail:
+          'Key (monitorStatusId)=(cfc2f04f-79cb-4344-8c54-dafe5e3a290c) is not present in table "MonitorStatus".',
+      });
+
+      expect(translated).toBeInstanceOf(BadDataException);
+      expect((translated as Exception).message).toBe(
+        "This request references Monitor Status that does not exist. Please check the request and try again.",
+      );
+    });
+  });
+
+  describe("errors it should not touch", () => {
+    it("passes through a non-foreign-key Postgres error unchanged", () => {
+      const uniqueViolation: FakeQueryFailedError = {
+        message: "duplicate key value violates unique constraint",
+        code: "23505",
+        table: "Project",
+        detail: "Key (slug)=(acme) already exists.",
+      };
+
+      expect(PostgresErrorTranslator.translate(uniqueViolation)).toBe(
+        uniqueViolation,
+      );
+    });
+
+    it("passes through an ordinary Exception unchanged", () => {
+      const exception: BadDataException = new BadDataException("Nope");
+
+      expect(PostgresErrorTranslator.translate(exception)).toBe(exception);
+    });
+
+    it("passes through null and non-objects unchanged", () => {
+      expect(PostgresErrorTranslator.translate(null)).toBeNull();
+      expect(PostgresErrorTranslator.translate("boom")).toBe("boom");
+    });
+
+    it("passes through a 23503 with an unrecognised detail unchanged", () => {
+      const odd: FakeQueryFailedError = {
+        message: "foreign key",
+        code: "23503",
+        table: "MonitorStatusTimeline",
+        detail: "something we have not seen before",
+      };
+
+      expect(PostgresErrorTranslator.translate(odd)).toBe(odd);
+    });
+  });
+});