@oneuptime/common 11.7.1 → 11.7.3

package/Tests/Server/Services/StatusPageDomainResolutionCache.test.ts

@@ -0,0 +1,245 @@
+/**
+ * StatusPageService domain-to-id resolution cache tests.
+ *
+ * Every public status-page API call served on a custom domain (overview,
+ * incidents, announcements, polling — several per page view) starts by
+ * resolving Host header -> statusPageId, so resolveStatusPageIdOrNull now
+ * consults a per-process 60s TTL cache before querying
+ * StatusPageDomainService. The contract this pins is load-bearing in three
+ * ways:
+ * - only SUCCESSFUL resolutions are cached: a freshly verified domain works
+ *   immediately, and attacker-controlled Host headers cannot fill the cache
+ *   with negative entries
+ * - the cache stores the id as a STRING and hands out a fresh ObjectID per
+ *   hit, so a caller mutating the returned id cannot poison every subsequent
+ *   request on that domain
+ * - keys are exactly as case-sensitive as the underlying query, so the cache
+ *   can never resolve a domain the database would not
+ *
+ * StatusPageDomainService.findOneBy is spied on, so no database is touched.
+ */
+
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import StatusPageDomainService from "../../../Server/Services/StatusPageDomainService";
+import StatusPageDomain from "../../../Models/DatabaseModels/StatusPageDomain";
+import ObjectID from "../../../Types/ObjectID";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  test,
+  jest,
+} from "@jest/globals";
+
+const VALID_UUID: string = "550e8400-e29b-41d4-a716-446655440000";
+const SECOND_UUID: string = "660e8400-e29b-41d4-a716-446655440111";
+const DOMAIN: string = "status.company.com";
+const OTHER_DOMAIN: string = "status.other.com";
+const TTL_MS: number = 60 * 1000;
+
+function statusPageDomainWith(statusPageId: ObjectID): StatusPageDomain {
+  return {
+    statusPageId: statusPageId,
+  } as unknown as StatusPageDomain;
+}
+
+function spyOnDomainFindOneBy(): jest.SpyInstance {
+  return jest.spyOn(
+    StatusPageDomainService,
+    "findOneBy",
+  ) as unknown as jest.SpyInstance;
+}
+
+function queriedDomains(spy: jest.SpyInstance): Array<string> {
+  return spy.mock.calls.map((call: Array<unknown>) => {
+    const args: Record<string, any> = call[0] as Record<string, any>;
+    return args["query"]["fullDomain"] as string;
+  });
+}
+
+describe("StatusPageService domain resolution cache", () => {
+  beforeEach(() => {
+    /*
+     * The cache lives on the singleton service, so entries written by one
+     * test would leak into the next (and into other suites sharing this
+     * module registry) without an explicit clear.
+     */
+    StatusPageService.clearStatusPageDomainToIdCache();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("caches a successful resolution: second call within TTL issues no query", async () => {
+    const domainSpy: jest.SpyInstance =
+      spyOnDomainFindOneBy().mockResolvedValue(
+        statusPageDomainWith(new ObjectID(VALID_UUID)) as never,
+      );
+
+    const first: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    const second: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+
+    expect(first?.toString()).toBe(VALID_UUID);
+    expect(second?.toString()).toBe(VALID_UUID);
+    expect(domainSpy).toHaveBeenCalledTimes(1);
+  });
+
+  test("does not cache a miss: two calls for an unknown domain issue two queries", async () => {
+    const domainSpy: jest.SpyInstance =
+      spyOnDomainFindOneBy().mockResolvedValue(null as never);
+
+    await expect(
+      StatusPageService.resolveStatusPageIdOrNull(DOMAIN),
+    ).resolves.toBeNull();
+    await expect(
+      StatusPageService.resolveStatusPageIdOrNull(DOMAIN),
+    ).resolves.toBeNull();
+
+    expect(domainSpy).toHaveBeenCalledTimes(2);
+  });
+
+  test("expires after the 60s TTL and re-queries", async () => {
+    const base: number = Date.now();
+    let nowMs: number = base;
+    jest.spyOn(Date, "now").mockImplementation((): number => {
+      return nowMs;
+    });
+
+    const domainSpy: jest.SpyInstance =
+      spyOnDomainFindOneBy().mockResolvedValue(
+        statusPageDomainWith(new ObjectID(VALID_UUID)) as never,
+      );
+
+    await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    expect(domainSpy).toHaveBeenCalledTimes(1);
+
+    // Just inside the TTL: still served from cache.
+    nowMs = base + TTL_MS - 1;
+    const withinTtl: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    expect(withinTtl?.toString()).toBe(VALID_UUID);
+    expect(domainSpy).toHaveBeenCalledTimes(1);
+
+    // Past the TTL: the entry has expired and the domain is re-queried.
+    nowMs = base + TTL_MS + 1;
+    const afterTtl: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    expect(afterTtl?.toString()).toBe(VALID_UUID);
+    expect(domainSpy).toHaveBeenCalledTimes(2);
+  });
+
+  test("keys are exactly as case-sensitive as the query: differently-cased domains each query", async () => {
+    const domainSpy: jest.SpyInstance =
+      spyOnDomainFindOneBy().mockResolvedValue(
+        statusPageDomainWith(new ObjectID(VALID_UUID)) as never,
+      );
+
+    await StatusPageService.resolveStatusPageIdOrNull("status.example.com");
+    await StatusPageService.resolveStatusPageIdOrNull("Status.Example.com");
+
+    /*
+     * If the cache normalized case it would resolve hostnames the underlying
+     * (case-sensitive) query would not, so a cached hit for one casing must
+     * not serve the other.
+     */
+    expect(domainSpy).toHaveBeenCalledTimes(2);
+    expect(queriedDomains(domainSpy)).toEqual([
+      "status.example.com",
+      "Status.Example.com",
+    ]);
+  });
+
+  test("clearStatusPageDomainToIdCache(domain) evicts only that domain", async () => {
+    const domainSpy: jest.SpyInstance =
+      spyOnDomainFindOneBy().mockImplementation(((
+        options: Record<string, any>,
+      ): Promise<StatusPageDomain> => {
+        const fullDomain: string = options["query"]["fullDomain"] as string;
+        return Promise.resolve(
+          statusPageDomainWith(
+            new ObjectID(fullDomain === DOMAIN ? VALID_UUID : SECOND_UUID),
+          ),
+        );
+      }) as never);
+
+    await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    await StatusPageService.resolveStatusPageIdOrNull(OTHER_DOMAIN);
+    expect(domainSpy).toHaveBeenCalledTimes(2);
+
+    StatusPageService.clearStatusPageDomainToIdCache(DOMAIN);
+
+    const reresolved: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    const stillCached: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(OTHER_DOMAIN);
+
+    expect(reresolved?.toString()).toBe(VALID_UUID);
+    expect(stillCached?.toString()).toBe(SECOND_UUID);
+    // Only the evicted domain re-queried; the other stayed cached.
+    expect(domainSpy).toHaveBeenCalledTimes(3);
+    expect(queriedDomains(domainSpy)).toEqual([DOMAIN, OTHER_DOMAIN, DOMAIN]);
+  });
+
+  test("clearStatusPageDomainToIdCache() with no argument clears everything", async () => {
+    const domainSpy: jest.SpyInstance =
+      spyOnDomainFindOneBy().mockResolvedValue(
+        statusPageDomainWith(new ObjectID(VALID_UUID)) as never,
+      );
+
+    await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    await StatusPageService.resolveStatusPageIdOrNull(OTHER_DOMAIN);
+    expect(domainSpy).toHaveBeenCalledTimes(2);
+
+    StatusPageService.clearStatusPageDomainToIdCache();
+
+    await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    await StatusPageService.resolveStatusPageIdOrNull(OTHER_DOMAIN);
+    expect(domainSpy).toHaveBeenCalledTimes(4);
+  });
+
+  test("UUID input never touches the domain cache or the domain service", async () => {
+    const domainSpy: jest.SpyInstance = spyOnDomainFindOneBy();
+
+    const result: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(VALID_UUID);
+
+    expect(result?.toString()).toBe(VALID_UUID);
+    expect(domainSpy).not.toHaveBeenCalled();
+  });
+
+  test("invalid dotless input returns null without querying", async () => {
+    const domainSpy: jest.SpyInstance = spyOnDomainFindOneBy();
+
+    await expect(
+      StatusPageService.resolveStatusPageIdOrNull("localhost"),
+    ).resolves.toBeNull();
+    expect(domainSpy).not.toHaveBeenCalled();
+  });
+
+  test("cached hits return a fresh ObjectID each call, so mutation cannot poison the cache", async () => {
+    spyOnDomainFindOneBy().mockResolvedValue(
+      statusPageDomainWith(new ObjectID(VALID_UUID)) as never,
+    );
+
+    // First call fills the cache; the next two are served from it.
+    await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    const firstHit: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    const secondHit: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+
+    expect(firstHit?.toString()).toBe(VALID_UUID);
+    expect(secondHit?.toString()).toBe(VALID_UUID);
+    expect(firstHit).not.toBe(secondHit);
+
+    // Mutating a returned instance must not leak into later hits.
+    firstHit!.id = "poisoned";
+    const thirdHit: ObjectID | null =
+      await StatusPageService.resolveStatusPageIdOrNull(DOMAIN);
+    expect(thirdHit?.toString()).toBe(VALID_UUID);
+  });
+});

package/Tests/Server/Services/StatusPageOverviewTimelineWindow.test.ts

@@ -0,0 +1,283 @@
+import StatusPageAPI from "../../../Server/API/StatusPageAPI";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import StatusPageGroupService from "../../../Server/Services/StatusPageGroupService";
+import StatusPageResourceService from "../../../Server/Services/StatusPageResourceService";
+import MonitorStatusService from "../../../Server/Services/MonitorStatusService";
+import MonitorGroupService from "../../../Server/Services/MonitorGroupService";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import ObjectID from "../../../Types/ObjectID";
+import OneUptimeDate from "../../../Types/Date";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * StatusPageAPI.getStatusPageResourcesAndTimelines timeline-window
+ * computation.
+ *
+ * The overview endpoint used to issue a SEPARATE one-column StatusPage query
+ * (statusPageForDays) just to read showUptimeHistoryInDays and compute the
+ * monitor-timeline window. That query was deleted: the helper's
+ * startDateForMonitorTimeline/endDateForMonitorTimeline params became
+ * optional, and when omitted the window is computed from the status page row
+ * the helper ALREADY fetches — showUptimeHistoryInDays clamped to 1..90 days
+ * (falsy hits `|| 90` BEFORE the < 1 clamp, so 0 means 90, not 1), ending
+ * now. The computed window is also RETURNED so the overview handler can keep
+ * serving it to the client.
+ *
+ * These tests pin: verbatim forwarding of explicit dates, the computed
+ * window and its clamp ORDER, that the returned dates are exactly what the
+ * timeline query received, and that the helper issues exactly ONE
+ * StatusPageService.findOneBy — so the deleted per-request query cannot
+ * sneak back on the hottest public endpoint in the product.
+ *
+ * All service reads are spied on — no database is touched.
+ */
+
+type ResourcesAndTimelinesResult = Awaited<
+  ReturnType<StatusPageAPI["getStatusPageResourcesAndTimelines"]>
+>;
+
+type TimelineHelperArgs = {
+  monitorIds: Array<ObjectID>;
+  startDate: Date;
+  endDate: Date;
+};
+
+function makeStatusPage(showUptimeHistoryInDays: number | undefined): {
+  statusPageId: ObjectID;
+  statusPage: StatusPage;
+} {
+  const statusPageId: ObjectID = ObjectID.generate();
+  const statusPage: StatusPage = new StatusPage();
+  statusPage._id = statusPageId.toString();
+  statusPage.projectId = ObjectID.generate();
+  if (showUptimeHistoryInDays !== undefined) {
+    statusPage.showUptimeHistoryInDays = showUptimeHistoryInDays;
+  }
+  return { statusPageId, statusPage };
+}
+
+type Spies = {
+  findOneBySpy: jest.SpyInstance;
+  timelineSpy: jest.SpyInstance;
+};
+
+/*
+ * The page is kept EMPTY (no resources, no groups) so every downstream loop
+ * short-circuits and the only interesting behavior left is the window
+ * computation itself.
+ */
+function mockEmptyStatusPage(statusPage: StatusPage): Spies {
+  const findOneBySpy: jest.SpyInstance = (
+    jest.spyOn(StatusPageService, "findOneBy") as unknown as jest.SpyInstance
+  ).mockResolvedValue(statusPage as never);
+
+  (
+    jest.spyOn(MonitorStatusService, "findBy") as unknown as jest.SpyInstance
+  ).mockResolvedValue([] as never);
+
+  (
+    jest.spyOn(StatusPageGroupService, "findBy") as unknown as jest.SpyInstance
+  ).mockResolvedValue([] as never);
+
+  (
+    jest.spyOn(
+      StatusPageResourceService,
+      "findBy",
+    ) as unknown as jest.SpyInstance
+  ).mockResolvedValue([] as never);
+
+  (
+    jest.spyOn(
+      MonitorGroupService,
+      "getMonitorGroupResourcesByGroupIds",
+    ) as unknown as jest.SpyInstance
+  ).mockResolvedValue({} as never);
+
+  (
+    jest.spyOn(
+      MonitorGroupService,
+      "getCurrentStatusesForMonitorGroups",
+    ) as unknown as jest.SpyInstance
+  ).mockResolvedValue({} as never);
+
+  const timelineSpy: jest.SpyInstance = (
+    jest.spyOn(
+      StatusPageService,
+      "getMonitorStatusTimelineForStatusPage",
+    ) as unknown as jest.SpyInstance
+  ).mockResolvedValue([] as never);
+
+  return { findOneBySpy, timelineSpy };
+}
+
+function timelineArgs(timelineSpy: jest.SpyInstance): TimelineHelperArgs {
+  expect(timelineSpy).toHaveBeenCalledTimes(1);
+  return timelineSpy.mock.calls[0]![0] as TimelineHelperArgs;
+}
+
+function dayDifference(startDate: Date, endDate: Date): number {
+  const msPerDay: number = 24 * 60 * 60 * 1000;
+  return (endDate.getTime() - startDate.getTime()) / msPerDay;
+}
+
+async function runWithConfiguredDays(data: {
+  showUptimeHistoryInDays: number | undefined;
+}): Promise<{
+  result: ResourcesAndTimelinesResult;
+  spies: Spies;
+}> {
+  const { statusPageId, statusPage } = makeStatusPage(
+    data.showUptimeHistoryInDays,
+  );
+  const spies: Spies = mockEmptyStatusPage(statusPage);
+  const api: StatusPageAPI = new StatusPageAPI();
+
+  const result: ResourcesAndTimelinesResult =
+    await api.getStatusPageResourcesAndTimelines({
+      statusPageId: statusPageId,
+    });
+
+  return { result, spies };
+}
+
+async function expectComputedWindowOfDays(data: {
+  showUptimeHistoryInDays: number | undefined;
+  expectedDays: number;
+}): Promise<void> {
+  const { result, spies } = await runWithConfiguredDays({
+    showUptimeHistoryInDays: data.showUptimeHistoryInDays,
+  });
+
+  const args: TimelineHelperArgs = timelineArgs(spies.timelineSpy);
+
+  // endDate is "now" (generous tolerance for slow CI).
+  expect(
+    Math.abs(args.endDate.getTime() - OneUptimeDate.getCurrentDate().getTime()),
+  ).toBeLessThan(10 * 1000);
+
+  // The window spans exactly the clamped number of days.
+  expect(dayDifference(args.startDate, args.endDate)).toBeCloseTo(
+    data.expectedDays,
+    2,
+  );
+
+  // The returned window is EXACTLY what the timeline query received.
+  expect(result.startDateForMonitorTimeline).toBe(args.startDate);
+  expect(result.endDateForMonitorTimeline).toBe(args.endDate);
+
+  // Exactly one StatusPage row fetch — the deleted query must not return.
+  expect(spies.findOneBySpy).toHaveBeenCalledTimes(1);
+}
+
+describe("StatusPageAPI.getStatusPageResourcesAndTimelines timeline window", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("explicit dates", () => {
+    test("are forwarded verbatim to the timeline query and returned unchanged", async () => {
+      const { statusPageId, statusPage } = makeStatusPage(45);
+      const spies: Spies = mockEmptyStatusPage(statusPage);
+      const getSomeDaysAgoSpy: jest.SpyInstance = jest.spyOn(
+        OneUptimeDate,
+        "getSomeDaysAgo",
+      ) as unknown as jest.SpyInstance;
+      const api: StatusPageAPI = new StatusPageAPI();
+
+      const explicitStartDate: Date = new Date("2026-01-05T00:00:00.000Z");
+      const explicitEndDate: Date = new Date("2026-01-19T00:00:00.000Z");
+
+      const result: ResourcesAndTimelinesResult =
+        await api.getStatusPageResourcesAndTimelines({
+          statusPageId: statusPageId,
+          startDateForMonitorTimeline: explicitStartDate,
+          endDateForMonitorTimeline: explicitEndDate,
+        });
+
+      const args: TimelineHelperArgs = timelineArgs(spies.timelineSpy);
+      // Same Date INSTANCES, not recomputed lookalikes.
+      expect(args.startDate).toBe(explicitStartDate);
+      expect(args.endDate).toBe(explicitEndDate);
+      expect(result.startDateForMonitorTimeline).toBe(explicitStartDate);
+      expect(result.endDateForMonitorTimeline).toBe(explicitEndDate);
+
+      // No window computation happened (showUptimeHistoryInDays ignored).
+      expect(getSomeDaysAgoSpy).not.toHaveBeenCalled();
+      expect(spies.findOneBySpy).toHaveBeenCalledTimes(1);
+    });
+
+    test("supplying only ONE of the two dates recomputes BOTH from the page config", async () => {
+      /*
+       * The guard is `!startDate || !endDate` — a half-specified window is
+       * treated as unspecified, so the caller-provided half is DISCARDED in
+       * favor of the page-configured window.
+       */
+      const { statusPageId, statusPage } = makeStatusPage(45);
+      const spies: Spies = mockEmptyStatusPage(statusPage);
+      const api: StatusPageAPI = new StatusPageAPI();
+
+      const explicitStartDate: Date = new Date("2026-01-05T00:00:00.000Z");
+
+      const result: ResourcesAndTimelinesResult =
+        await api.getStatusPageResourcesAndTimelines({
+          statusPageId: statusPageId,
+          startDateForMonitorTimeline: explicitStartDate,
+        });
+
+      const args: TimelineHelperArgs = timelineArgs(spies.timelineSpy);
+      expect(args.startDate).not.toBe(explicitStartDate);
+      expect(dayDifference(args.startDate, args.endDate)).toBeCloseTo(45, 2);
+      expect(result.startDateForMonitorTimeline).toBe(args.startDate);
+      expect(result.endDateForMonitorTimeline).toBe(args.endDate);
+    });
+  });
+
+  describe("omitted dates: window computed from showUptimeHistoryInDays", () => {
+    test("45 configured days -> 45-day window ending now", async () => {
+      await expectComputedWindowOfDays({
+        showUptimeHistoryInDays: 45,
+        expectedDays: 45,
+      });
+    });
+
+    test("200 configured days clamps DOWN to a 90-day window", async () => {
+      await expectComputedWindowOfDays({
+        showUptimeHistoryInDays: 200,
+        expectedDays: 90,
+      });
+    });
+
+    test("undefined (column never set) defaults to a 90-day window", async () => {
+      await expectComputedWindowOfDays({
+        showUptimeHistoryInDays: undefined,
+        expectedDays: 90,
+      });
+    });
+
+    test("0 hits the `|| 90` falsy default BEFORE the < 1 clamp -> 90 days, NOT 1", async () => {
+      /*
+       * ORDER matters and is pinned: `showUptimeHistoryInDays || 90` runs
+       * first, so a falsy 0 becomes the 90-day default. Only truthy
+       * sub-1 values (fractions, negatives) reach the < 1 clamp below it.
+       */
+      await expectComputedWindowOfDays({
+        showUptimeHistoryInDays: 0,
+        expectedDays: 90,
+      });
+    });
+
+    test("0.5 (truthy but < 1) clamps UP to a 1-day window", async () => {
+      await expectComputedWindowOfDays({
+        showUptimeHistoryInDays: 0.5,
+        expectedDays: 1,
+      });
+    });
+
+    test("-5 (truthy, < 1) clamps UP to a 1-day window", async () => {
+      await expectComputedWindowOfDays({
+        showUptimeHistoryInDays: -5,
+        expectedDays: 1,
+      });
+    });
+  });
+});

package/Tests/Server/Services/StatusPageServiceMcp.test.ts

@@ -18,7 +18,14 @@ import StatusPageDomainService from "../../../Server/Services/StatusPageDomainSe
 import StatusPage from "../../../Models/DatabaseModels/StatusPage";
 import StatusPageDomain from "../../../Models/DatabaseModels/StatusPageDomain";
 import ObjectID from "../../../Types/ObjectID";
-import { afterEach, describe, expect, test, jest } from "@jest/globals";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  test,
+  jest,
+} from "@jest/globals";
 
 const VALID_UUID: string = "550e8400-e29b-41d4-a716-446655440000";
 const DOMAIN: string = "status.company.com";
@@ -48,6 +55,15 @@ function spyOnDomainFindOneBy(): jest.SpyInstance {
 }
 
 describe("StatusPageService MCP gate", () => {
+  beforeEach(() => {
+    /*
+     * resolveStatusPageIdOrNull caches successful domain resolutions on the
+     * singleton service, so a hit in one test would short-circuit the mocked
+     * domain query in the next.
+     */
+    StatusPageService.clearStatusPageDomainToIdCache();
+  });
+
   afterEach(() => {
     jest.restoreAllMocks();
   });