@oneuptime/common 11.7.1 → 11.7.3

package/Tests/Server/Utils/Incident/IncidentPrivacyFilter.test.ts

@@ -0,0 +1,264 @@
+import {
+  applyIncidentRelatedRecordPrivacyFilter,
+  applyIncidentSelfPrivacyFilter,
+  getIncidentRelatedRecordPrivacyRaw,
+  getIncidentSelfPrivacyRaw,
+  shouldBypassIncidentPrivacy,
+} from "../../../../Server/Utils/Incident/IncidentPrivacyFilter";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+import { FindOperator } from "typeorm";
+
+/*
+ * IncidentPrivacyFilter decides who may see a private incident. Getting it
+ * wrong either leaks private incidents to every project member, or hides an
+ * owner's own incidents from them - so each branch is pinned here against the
+ * SQL the Raw clause actually emits, not just its presence.
+ */
+
+const userId: ObjectID = ObjectID.generate();
+const tenantId: ObjectID = ObjectID.generate();
+
+type MakePermFunction = (
+  permission: Permission,
+) => DatabaseCommonInteractionProps;
+
+// A logged-in project member holding exactly the one permission named.
+const propsWithProjectPermission: MakePermFunction = (
+  permission: Permission,
+): DatabaseCommonInteractionProps => {
+  const userPermission: UserPermission = {
+    _type: "UserPermission",
+    permission: permission,
+    labelIds: [],
+  };
+
+  const tenantPermission: UserTenantAccessPermission = {
+    _type: "UserTenantAccessPermission",
+    projectId: tenantId,
+    permissions: [userPermission],
+  };
+
+  return {
+    userId: userId,
+    tenantId: tenantId,
+    userTenantAccessPermission: {
+      [tenantId.toString()]: tenantPermission,
+    },
+  };
+};
+
+// Pull the SQL + bound params out of a typeorm Raw() FindOperator.
+/* eslint-disable @typescript-eslint/no-explicit-any */
+type RawParts = { sql: string; params: Record<string, string> };
+
+const rawParts: (clause: unknown) => RawParts = (clause: unknown): RawParts => {
+  const operator: any = clause as any;
+
+  return {
+    sql: String(operator._getSql("COLUMN")),
+    params: (operator._objectLiteralParameters || {}) as Record<string, string>,
+  };
+};
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+describe("shouldBypassIncidentPrivacy", () => {
+  test("root and master-admin contexts see everything", () => {
+    expect(shouldBypassIncidentPrivacy({ isRoot: true })).toBe(true);
+    expect(shouldBypassIncidentPrivacy({ isMasterAdmin: true })).toBe(true);
+  });
+
+  test("project owners and admins bypass the filter", () => {
+    expect(
+      shouldBypassIncidentPrivacy(
+        propsWithProjectPermission(Permission.ProjectOwner),
+      ),
+    ).toBe(true);
+    expect(
+      shouldBypassIncidentPrivacy(
+        propsWithProjectPermission(Permission.ProjectAdmin),
+      ),
+    ).toBe(true);
+  });
+
+  test("an ordinary project member does NOT bypass", () => {
+    expect(
+      shouldBypassIncidentPrivacy(
+        propsWithProjectPermission(Permission.ProjectMember),
+      ),
+    ).toBe(false);
+  });
+
+  test("an admin permission carried under a DIFFERENT tenant does not count", () => {
+    const props: DatabaseCommonInteractionProps = propsWithProjectPermission(
+      Permission.ProjectOwner,
+    );
+
+    // Caller now claims a tenant they hold no permission entry for.
+    props.tenantId = ObjectID.generate();
+
+    expect(shouldBypassIncidentPrivacy(props)).toBe(false);
+  });
+
+  test("no tenant / no permissions is not a bypass", () => {
+    expect(shouldBypassIncidentPrivacy({ userId: userId })).toBe(false);
+    expect(shouldBypassIncidentPrivacy({})).toBe(false);
+  });
+});
+
+describe("getIncidentSelfPrivacyRaw", () => {
+  test("returns undefined for a caller who bypasses the filter", () => {
+    expect(getIncidentSelfPrivacyRaw({ isRoot: true })).toBeUndefined();
+    expect(
+      getIncidentSelfPrivacyRaw(
+        propsWithProjectPermission(Permission.ProjectAdmin),
+      ),
+    ).toBeUndefined();
+  });
+
+  test("an anonymous caller only ever sees non-private incidents, with no bound params", () => {
+    const clause: unknown = getIncidentSelfPrivacyRaw({});
+
+    expect(clause).toBeInstanceOf(FindOperator);
+
+    const { sql, params }: RawParts = rawParts(clause);
+
+    // Non-private rows only: NULL or FALSE. No owner escape hatch.
+    expect(sql).toContain("COLUMN IS NULL OR COLUMN = FALSE");
+    expect(sql).not.toContain("IncidentOwnerUser");
+    expect(Object.keys(params)).toHaveLength(0);
+  });
+
+  test("a logged-in user also sees private incidents they own directly or via a team", () => {
+    const clause: unknown = getIncidentSelfPrivacyRaw({ userId: userId });
+
+    const { sql, params }: RawParts = rawParts(clause);
+
+    expect(sql).toContain("COLUMN IS NULL OR COLUMN = FALSE");
+    expect(sql).toContain("IncidentOwnerUser");
+    expect(sql).toContain("IncidentOwnerTeam");
+    expect(sql).toContain("TeamMember");
+    // Soft-deleted ownership rows must not grant visibility.
+    expect(sql).toContain(`iou."deletedAt" IS NULL`);
+    expect(sql).toContain(`tm."deletedAt" IS NULL`);
+
+    // The clause is bound to exactly this user, once.
+    const values: Array<string> = Object.values(params);
+    expect(values).toEqual([userId.toString()]);
+  });
+
+  test("uses a fresh parameter name per call so two clauses cannot collide", () => {
+    const first: RawParts = rawParts(getIncidentSelfPrivacyRaw({ userId }));
+    const second: RawParts = rawParts(getIncidentSelfPrivacyRaw({ userId }));
+
+    expect(Object.keys(first.params)).not.toEqual(Object.keys(second.params));
+  });
+});
+
+describe("getIncidentRelatedRecordPrivacyRaw", () => {
+  test("returns undefined for a bypassing caller", () => {
+    expect(
+      getIncidentRelatedRecordPrivacyRaw({ isRoot: true }),
+    ).toBeUndefined();
+  });
+
+  test("anonymous callers are scoped to child rows of non-private incidents only", () => {
+    const clause: unknown = getIncidentRelatedRecordPrivacyRaw({});
+
+    const { sql, params }: RawParts = rawParts(clause);
+
+    // Child rows are gated on the parent Incident being non-private.
+    expect(sql).toContain(`FROM "Incident" i`);
+    expect(sql).toContain(`i."isPrivate" IS NULL OR i."isPrivate" = FALSE`);
+    expect(sql).not.toContain("IncidentOwnerUser");
+    expect(Object.keys(params)).toHaveLength(0);
+  });
+
+  test("a logged-in user's child rows also include incidents they own", () => {
+    const clause: unknown = getIncidentRelatedRecordPrivacyRaw({ userId });
+
+    const { sql, params }: RawParts = rawParts(clause);
+
+    expect(sql).toContain("IncidentOwnerUser");
+    expect(sql).toContain("IncidentOwnerTeam");
+    expect(Object.values(params)).toEqual([userId.toString()]);
+  });
+});
+
+describe("applyIncidentSelfPrivacyFilter", () => {
+  test("returns the query untouched for a bypassing caller", () => {
+    const query: { projectId: ObjectID } = { projectId: tenantId };
+    const result: { projectId: ObjectID; isPrivate?: unknown } =
+      applyIncidentSelfPrivacyFilter(query, { isRoot: true });
+
+    expect(result).toBe(query);
+    expect(result.isPrivate).toBeUndefined();
+  });
+
+  test("builds a fresh query object when none is supplied", () => {
+    const result: { isPrivate?: unknown } = applyIncidentSelfPrivacyFilter(
+      undefined as unknown as { isPrivate?: unknown },
+      { userId },
+    );
+
+    expect(result.isPrivate).toBeInstanceOf(FindOperator);
+  });
+
+  test("sets the privacy clause on isPrivate while leaving other keys intact", () => {
+    const projectId: ObjectID = ObjectID.generate();
+    const result: { projectId: ObjectID; isPrivate?: unknown } =
+      applyIncidentSelfPrivacyFilter({ projectId }, { userId });
+
+    expect(result.projectId).toBe(projectId);
+    expect(result.isPrivate).toBeInstanceOf(FindOperator);
+  });
+
+  test("ANDs an existing isPrivate value together with the forced clause", () => {
+    const result: { isPrivate?: unknown } = applyIncidentSelfPrivacyFilter(
+      { isPrivate: false },
+      { userId },
+    );
+
+    // combineWithPrivacyClause wraps the caller value + clause in And(...).
+    const rendered: unknown = result.isPrivate;
+    expect(rendered).toBeInstanceOf(FindOperator);
+    /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+    expect(String((rendered as any)._type)).toBe("and");
+  });
+});
+
+describe("applyIncidentRelatedRecordPrivacyFilter", () => {
+  test("returns the query untouched for a bypassing caller", () => {
+    const query: { incidentId: ObjectID } = { incidentId: ObjectID.generate() };
+    const result: { incidentId: unknown } =
+      applyIncidentRelatedRecordPrivacyFilter(query, { isMasterAdmin: true });
+
+    expect(result).toBe(query);
+  });
+
+  test("builds { incidentId: clause } when no query is supplied", () => {
+    const result: { incidentId?: unknown } =
+      applyIncidentRelatedRecordPrivacyFilter(
+        undefined as unknown as { incidentId?: unknown },
+        { userId },
+      );
+
+    expect(result.incidentId).toBeInstanceOf(FindOperator);
+  });
+
+  test("ANDs an existing incidentId filter so a per-incident query cannot widen", () => {
+    const incidentId: ObjectID = ObjectID.generate();
+    const result: { incidentId?: unknown } =
+      applyIncidentRelatedRecordPrivacyFilter({ incidentId }, { userId });
+
+    const rendered: unknown = result.incidentId;
+    expect(rendered).toBeInstanceOf(FindOperator);
+    /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+    expect(String((rendered as any)._type)).toBe("and");
+  });
+});

package/Tests/Server/Utils/IncidentEpisode/IncidentEpisodePrivacyFilter.test.ts

@@ -0,0 +1,175 @@
+import {
+  applyIncidentEpisodeRelatedRecordPrivacyFilter,
+  applyIncidentEpisodeSelfPrivacyFilter,
+  getIncidentEpisodeRelatedRecordPrivacyRaw,
+  getIncidentEpisodeSelfPrivacyRaw,
+  shouldBypassIncidentEpisodePrivacy,
+} from "../../../../Server/Utils/IncidentEpisode/IncidentEpisodePrivacyFilter";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+import { FindOperator } from "typeorm";
+
+/*
+ * Incident-episode privacy mirrors incident privacy: an episode is private when
+ * its incident is, and only owners (plus project owners/admins/root) may see
+ * private episodes. The emitted SQL is pinned so a wrong table/column or a
+ * dropped soft-delete guard is caught.
+ */
+
+const userId: ObjectID = ObjectID.generate();
+const tenantId: ObjectID = ObjectID.generate();
+
+const propsWithProjectPermission: (
+  permission: Permission,
+) => DatabaseCommonInteractionProps = (
+  permission: Permission,
+): DatabaseCommonInteractionProps => {
+  const userPermission: UserPermission = {
+    _type: "UserPermission",
+    permission: permission,
+    labelIds: [],
+  };
+
+  const tenantPermission: UserTenantAccessPermission = {
+    _type: "UserTenantAccessPermission",
+    projectId: tenantId,
+    permissions: [userPermission],
+  };
+
+  return {
+    userId: userId,
+    tenantId: tenantId,
+    userTenantAccessPermission: {
+      [tenantId.toString()]: tenantPermission,
+    },
+  };
+};
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+type RawParts = { sql: string; params: Record<string, string> };
+
+const rawParts: (clause: unknown) => RawParts = (clause: unknown): RawParts => {
+  const operator: any = clause as any;
+
+  return {
+    sql: String(operator._getSql("COLUMN")),
+    params: (operator._objectLiteralParameters || {}) as Record<string, string>,
+  };
+};
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+describe("shouldBypassIncidentEpisodePrivacy", () => {
+  test("root, master-admin, owner and admin bypass; member does not", () => {
+    expect(shouldBypassIncidentEpisodePrivacy({ isRoot: true })).toBe(true);
+    expect(shouldBypassIncidentEpisodePrivacy({ isMasterAdmin: true })).toBe(
+      true,
+    );
+    expect(
+      shouldBypassIncidentEpisodePrivacy(
+        propsWithProjectPermission(Permission.ProjectOwner),
+      ),
+    ).toBe(true);
+    expect(
+      shouldBypassIncidentEpisodePrivacy(
+        propsWithProjectPermission(Permission.ProjectMember),
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("getIncidentEpisodeSelfPrivacyRaw", () => {
+  test("bypassing callers get no clause", () => {
+    expect(getIncidentEpisodeSelfPrivacyRaw({ isRoot: true })).toBeUndefined();
+  });
+
+  test("anonymous callers only see non-private episodes, no params bound", () => {
+    const { sql, params }: RawParts = rawParts(
+      getIncidentEpisodeSelfPrivacyRaw({}),
+    );
+
+    expect(sql).toContain("COLUMN IS NULL OR COLUMN = FALSE");
+    expect(sql).not.toContain("IncidentEpisodeOwnerUser");
+    expect(Object.keys(params)).toHaveLength(0);
+  });
+
+  test("a user also sees episodes they own, bound to their id", () => {
+    const { sql, params }: RawParts = rawParts(
+      getIncidentEpisodeSelfPrivacyRaw({ userId }),
+    );
+
+    expect(sql).toContain("IncidentEpisodeOwnerUser");
+    expect(sql).toContain("IncidentEpisodeOwnerTeam");
+    expect(sql).toContain(`ieou."deletedAt" IS NULL`);
+    expect(Object.values(params)).toEqual([userId.toString()]);
+  });
+
+  test("fresh parameter name per call", () => {
+    const first: RawParts = rawParts(
+      getIncidentEpisodeSelfPrivacyRaw({ userId }),
+    );
+    const second: RawParts = rawParts(
+      getIncidentEpisodeSelfPrivacyRaw({ userId }),
+    );
+    expect(Object.keys(first.params)).not.toEqual(Object.keys(second.params));
+  });
+});
+
+describe("getIncidentEpisodeRelatedRecordPrivacyRaw", () => {
+  test("anonymous callers are scoped to child rows of non-private episodes", () => {
+    const { sql }: RawParts = rawParts(
+      getIncidentEpisodeRelatedRecordPrivacyRaw({}),
+    );
+
+    expect(sql).toContain(`FROM "IncidentEpisode" ie`);
+    expect(sql).toContain(`ie."isPrivate" IS NULL OR ie."isPrivate" = FALSE`);
+  });
+
+  test("a user's child rows include episodes they own", () => {
+    const { sql, params }: RawParts = rawParts(
+      getIncidentEpisodeRelatedRecordPrivacyRaw({ userId }),
+    );
+
+    expect(sql).toContain("IncidentEpisodeOwnerUser");
+    expect(Object.values(params)).toEqual([userId.toString()]);
+  });
+});
+
+describe("apply* incident-episode filters", () => {
+  test("bypassing callers get their query back untouched", () => {
+    const query: { isPrivate?: unknown } = {};
+    expect(applyIncidentEpisodeSelfPrivacyFilter(query, { isRoot: true })).toBe(
+      query,
+    );
+  });
+
+  test("self filter sets isPrivate; related filter builds { incidentEpisodeId }", () => {
+    const self: { isPrivate?: unknown } = applyIncidentEpisodeSelfPrivacyFilter(
+      {},
+      { userId },
+    );
+    expect(self.isPrivate).toBeInstanceOf(FindOperator);
+
+    const related: { incidentEpisodeId?: unknown } =
+      applyIncidentEpisodeRelatedRecordPrivacyFilter(
+        undefined as unknown as { incidentEpisodeId?: unknown },
+        { userId },
+      );
+    expect(related.incidentEpisodeId).toBeInstanceOf(FindOperator);
+  });
+
+  test("an existing incidentEpisodeId filter is ANDed, not replaced", () => {
+    const incidentEpisodeId: ObjectID = ObjectID.generate();
+    const combined: { incidentEpisodeId?: unknown } =
+      applyIncidentEpisodeRelatedRecordPrivacyFilter(
+        { incidentEpisodeId },
+        { userId },
+      );
+    /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+    expect(String((combined.incidentEpisodeId as any)._type)).toBe("and");
+  });
+});

package/Tests/Server/Utils/Monitor/MonitorStepsProjectValidator.test.ts

@@ -0,0 +1,181 @@
+import MonitorStepsProjectValidator from "../../../../Server/Utils/Monitor/MonitorStepsProjectValidator";
+import AlertSeverityService from "../../../../Server/Services/AlertSeverityService";
+import IncidentSeverityService from "../../../../Server/Services/IncidentSeverityService";
+import MonitorStatusService from "../../../../Server/Services/MonitorStatusService";
+import AlertSeverity from "../../../../Models/DatabaseModels/AlertSeverity";
+import IncidentSeverity from "../../../../Models/DatabaseModels/IncidentSeverity";
+import MonitorStatus from "../../../../Models/DatabaseModels/MonitorStatus";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import ObjectID from "../../../../Types/ObjectID";
+import { JSONObject } from "../../../../Types/JSON";
+import { afterEach, describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * Contract under test: monitorSteps embeds ids of project-scoped records (the
+ * default monitor status, the status each criteria switches to, and the
+ * severities used to open incidents and alerts). Saving one that belongs to a
+ * *different* project is what tied two projects together in production and
+ * left the referenced project undeletable, so it must be rejected on write.
+ *
+ * The check has to stay narrow: monitorSteps is full of unrelated uuids (step
+ * ids, criteria ids, incident/alert template ids) that match no record at all,
+ * and those must keep saving fine.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "4af3a31b-58b0-4746-8025-f9cd4db1945e",
+);
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "3376855b-361c-427c-8982-bad7ada30414",
+);
+
+const OWN_STATUS_ID: string = "59b5ab80-63f6-4ffd-b3df-31c6ad127695";
+const FOREIGN_STATUS_ID: string = "cfc2f04f-79cb-4344-8c54-dafe5e3a290c";
+const FOREIGN_ALERT_SEVERITY_ID: string =
+  "a2eb67d4-bd2e-4186-9187-dad799c9316c";
+
+type FoundRecords = {
+  monitorStatuses?: Array<MonitorStatus>;
+  incidentSeverities?: Array<IncidentSeverity>;
+  alertSeverities?: Array<AlertSeverity>;
+};
+
+const monitorStatus: (id: string, projectId: ObjectID) => MonitorStatus = (
+  id: string,
+  projectId: ObjectID,
+): MonitorStatus => {
+  const status: MonitorStatus = new MonitorStatus();
+  status._id = id;
+  status.name = "Operational";
+  status.projectId = projectId;
+  return status;
+};
+
+const alertSeverity: (id: string, projectId: ObjectID) => AlertSeverity = (
+  id: string,
+  projectId: ObjectID,
+): AlertSeverity => {
+  const severity: AlertSeverity = new AlertSeverity();
+  severity._id = id;
+  severity.name = "High";
+  severity.projectId = projectId;
+  return severity;
+};
+
+const stubLookups: (found: FoundRecords) => void = (
+  found: FoundRecords,
+): void => {
+  jest
+    .spyOn(MonitorStatusService, "findBy")
+    .mockResolvedValue(found.monitorStatuses || []);
+  jest
+    .spyOn(IncidentSeverityService, "findBy")
+    .mockResolvedValue(found.incidentSeverities || []);
+  jest
+    .spyOn(AlertSeverityService, "findBy")
+    .mockResolvedValue(found.alertSeverities || []);
+};
+
+const stepsReferencing: (ids: Array<string>) => JSONObject = (
+  ids: Array<string>,
+): JSONObject => {
+  return {
+    _type: "MonitorSteps",
+    value: {
+      defaultMonitorStatusId: ids[0],
+      monitorStepsInstanceArray: ids.slice(1).map((id: string) => {
+        return { _type: "MonitorStep", value: { id: id } };
+      }),
+    },
+  };
+};
+
+describe("MonitorStepsProjectValidator", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("rejects a monitor status that belongs to another project", async () => {
+    stubLookups({
+      monitorStatuses: [monitorStatus(FOREIGN_STATUS_ID, OTHER_PROJECT_ID)],
+    });
+
+    await expect(
+      MonitorStepsProjectValidator.validateMonitorStepsBelongToProject({
+        monitorSteps: stepsReferencing([FOREIGN_STATUS_ID]),
+        projectId: PROJECT_ID,
+      }),
+    ).rejects.toThrow(BadDataException);
+  });
+
+  it("names every offending record in the message", async () => {
+    stubLookups({
+      monitorStatuses: [monitorStatus(FOREIGN_STATUS_ID, OTHER_PROJECT_ID)],
+      alertSeverities: [
+        alertSeverity(FOREIGN_ALERT_SEVERITY_ID, OTHER_PROJECT_ID),
+      ],
+    });
+
+    await expect(
+      MonitorStepsProjectValidator.validateMonitorStepsBelongToProject({
+        monitorSteps: stepsReferencing([
+          FOREIGN_STATUS_ID,
+          FOREIGN_ALERT_SEVERITY_ID,
+        ]),
+        projectId: PROJECT_ID,
+      }),
+    ).rejects.toThrow(
+      /Monitor Status "Operational".*Alert Severity "High"|Alert Severity "High".*Monitor Status "Operational"/,
+    );
+  });
+
+  it("accepts records that belong to the monitor's own project", async () => {
+    stubLookups({
+      monitorStatuses: [monitorStatus(OWN_STATUS_ID, PROJECT_ID)],
+    });
+
+    await expect(
+      MonitorStepsProjectValidator.validateMonitorStepsBelongToProject({
+        monitorSteps: stepsReferencing([OWN_STATUS_ID]),
+        projectId: PROJECT_ID,
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("ignores uuids that are not project-scoped records", async () => {
+    // Step ids and criteria ids are uuids too, and match nothing.
+    stubLookups({});
+
+    await expect(
+      MonitorStepsProjectValidator.validateMonitorStepsBelongToProject({
+        monitorSteps: stepsReferencing([
+          OWN_STATUS_ID,
+          "679a113f-669e-4b0f-b3db-31eb2a794ed5",
+          "ff11aa22-bb33-cc44-dd55-000000000ee1",
+        ]),
+        projectId: PROJECT_ID,
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("does no lookups when there are no monitorSteps or no project", async () => {
+    /*
+     * stubLookups installs the spy, so the lookup is asserted on the service
+     * method itself. Annotating the spy handle is not an option here: this
+     * file takes jest from @jest/globals, so spyOn returns jest-mock's type
+     * while the jest.SpyInstance namespace resolves to @types/jest's.
+     */
+    stubLookups({});
+
+    await MonitorStepsProjectValidator.validateMonitorStepsBelongToProject({
+      monitorSteps: undefined,
+      projectId: PROJECT_ID,
+    });
+    await MonitorStepsProjectValidator.validateMonitorStepsBelongToProject({
+      monitorSteps: stepsReferencing([OWN_STATUS_ID]),
+      projectId: undefined,
+    });
+
+    expect(MonitorStatusService.findBy).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/Monitor/NetworkDeviceWalkUtil.test.ts

@@ -76,7 +76,7 @@ function mockPipeline(options?: {
     );
   deviceUpdateSpy = jest
     .spyOn(NetworkDeviceService, "updateOneById")
-    .mockResolvedValue(undefined);
+    .mockResolvedValue(1);
   monitorFindSpy = jest
     .spyOn(MonitorService, "findBy")
     .mockResolvedValue(options?.monitors || []);

package/Tests/Server/Utils/Monitor/NetworkInventoryUtil.test.ts

@@ -53,13 +53,13 @@ function mockServices(existingInterfaces: Array<NetworkInterface> = []): void {
     .mockResolvedValue(ownedDevice);
   deviceUpdateSpy = jest
     .spyOn(NetworkDeviceService, "updateOneById")
-    .mockResolvedValue(undefined);
+    .mockResolvedValue(1);
   interfaceFindSpy = jest
     .spyOn(NetworkInterfaceService, "findBy")
     .mockResolvedValue(existingInterfaces);
   interfaceUpdateSpy = jest
     .spyOn(NetworkInterfaceService, "updateOneById")
-    .mockResolvedValue(undefined);
+    .mockResolvedValue(1);
   interfaceCreateSpy = jest
     .spyOn(NetworkInterfaceService, "create")
     .mockResolvedValue(new NetworkInterface());