@oneuptime/common 11.7.3 → 11.7.4

package/Tests/Server/Utils/DropFilterValidation.test.ts

@@ -0,0 +1,269 @@
+import {
+  DropFilterCandidate,
+  DropFilterValidationOptions,
+  isSqlExpressionValue,
+  SAMPLE_ACTION,
+  validateDropFilter,
+  validateDropFilterFilterQuery,
+  validateDropFilterSamplePercentage,
+} from "../../../Server/Utils/DropFilterValidation";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import {
+  MAX_SAMPLE_PERCENTAGE,
+  MIN_SAMPLE_PERCENTAGE,
+} from "../../../Types/Telemetry/DropFilterSampling";
+import LogDropFilterAction from "../../../Types/Log/LogDropFilterAction";
+import TraceDropFilterAction from "../../../Types/Trace/TraceDropFilterAction";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test — the save-time gate on drop filters.
+ *
+ * Both drop-filter models used to accept configurations the ingest engine
+ * could not honour, and both failed silently AND destructively:
+ *
+ *   - A blank `filterQuery` compiles to "match every record", so saving a
+ *     drop filter with an empty query discarded 100% of a project's
+ *     telemetry with nothing to notice it by.
+ *   - `action = "sample"` could be saved with no percentage, which the engine
+ *     read as "throw away half".
+ *
+ * The API boundary is the only place a human is present to read the error,
+ * which is why this runs on create and on update rather than only in the
+ * dashboard form.
+ */
+
+const LOGS: DropFilterValidationOptions = { recordNoun: "logs" };
+const SPANS: DropFilterValidationOptions = { recordNoun: "spans" };
+
+function candidate(
+  overrides: Partial<DropFilterCandidate>,
+): DropFilterCandidate {
+  return {
+    action: "drop",
+    samplePercentage: null,
+    filterQuery: "severityText = 'Error'",
+    ...overrides,
+  };
+}
+
+describe("drop filter action vocabulary", () => {
+  /*
+   * The validator compares a raw string so one implementation can serve both
+   * services. If either enum ever renames its member, this fails instead of
+   * silently skipping sample validation.
+   */
+  it("matches the literal both action enums use for sampling", () => {
+    expect(LogDropFilterAction.Sample).toBe(SAMPLE_ACTION);
+    expect(TraceDropFilterAction.Sample).toBe(SAMPLE_ACTION);
+  });
+});
+
+describe("validateDropFilterFilterQuery", () => {
+  it("accepts a query with an actual condition", () => {
+    expect(() => {
+      return validateDropFilterFilterQuery("body CONTAINS 'debug'", LOGS);
+    }).not.toThrow();
+  });
+
+  /*
+   * The destructive case: empty means match-all, and match-all plus a drop
+   * action means the project loses everything.
+   */
+  it("rejects an empty query", () => {
+    expect(() => {
+      return validateDropFilterFilterQuery("", LOGS);
+    }).toThrow(BadDataException);
+  });
+
+  it("rejects a whitespace-only query", () => {
+    for (const blank of [" ", "   ", "\t", "\n", " \t\n "]) {
+      expect(() => {
+        return validateDropFilterFilterQuery(blank, LOGS);
+      }).toThrow(BadDataException);
+    }
+  });
+
+  it("rejects a missing query", () => {
+    expect(() => {
+      return validateDropFilterFilterQuery(undefined, LOGS);
+    }).toThrow(BadDataException);
+    expect(() => {
+      return validateDropFilterFilterQuery(null, LOGS);
+    }).toThrow(BadDataException);
+  });
+
+  /*
+   * The message has to explain the consequence, not just name the field —
+   * "Filter query is required" alone does not tell someone that saving it
+   * blank would have deleted all their logs.
+   */
+  it("explains the consequence in the message, in the caller's vocabulary", () => {
+    expect(() => {
+      return validateDropFilterFilterQuery("", LOGS);
+    }).toThrow(/discard all of this project's logs/);
+
+    expect(() => {
+      return validateDropFilterFilterQuery("", SPANS);
+    }).toThrow(/discard all of this project's spans/);
+  });
+});
+
+describe("validateDropFilterSamplePercentage", () => {
+  it("ignores the percentage entirely for a drop-action filter", () => {
+    for (const percentage of [null, undefined, 0, -5, 100, 1000]) {
+      expect(() => {
+        return validateDropFilterSamplePercentage(
+          candidate({ action: "drop", samplePercentage: percentage }),
+          LOGS,
+        );
+      }).not.toThrow();
+    }
+  });
+
+  it("accepts a sample filter inside the usable range", () => {
+    for (const percentage of [
+      MIN_SAMPLE_PERCENTAGE,
+      10,
+      50,
+      MAX_SAMPLE_PERCENTAGE,
+    ]) {
+      expect(() => {
+        return validateDropFilterSamplePercentage(
+          candidate({ action: SAMPLE_ACTION, samplePercentage: percentage }),
+          LOGS,
+        );
+      }).not.toThrow();
+    }
+  });
+
+  it("rejects a sample filter with no percentage at all", () => {
+    for (const missing of [null, undefined]) {
+      expect(() => {
+        return validateDropFilterSamplePercentage(
+          candidate({ action: SAMPLE_ACTION, samplePercentage: missing }),
+          LOGS,
+        );
+      }).toThrow(BadDataException);
+    }
+  });
+
+  it("rejects a sample filter with a non-finite percentage", () => {
+    for (const bad of [NaN, Infinity, -Infinity]) {
+      expect(() => {
+        return validateDropFilterSamplePercentage(
+          candidate({ action: SAMPLE_ACTION, samplePercentage: bad }),
+          LOGS,
+        );
+      }).toThrow(BadDataException);
+    }
+  });
+
+  /*
+   * 0 and 100 are the two values a user reaches for when they mean something
+   * else. Point them at the tool that actually does it rather than accepting
+   * a filter the engine will treat as a no-op.
+   */
+  it("rejects 0 and points at the Drop action instead", () => {
+    expect(() => {
+      return validateDropFilterSamplePercentage(
+        candidate({ action: SAMPLE_ACTION, samplePercentage: 0 }),
+        LOGS,
+      );
+    }).toThrow(/"Drop" action/);
+  });
+
+  it("rejects 100 and points at disabling the filter instead", () => {
+    expect(() => {
+      return validateDropFilterSamplePercentage(
+        candidate({ action: SAMPLE_ACTION, samplePercentage: 100 }),
+        LOGS,
+      );
+    }).toThrow(/disable the filter/);
+  });
+
+  it("rejects percentages outside the range on both sides", () => {
+    for (const outOfRange of [-1, 0, 100, 101, 1000]) {
+      expect(() => {
+        return validateDropFilterSamplePercentage(
+          candidate({ action: SAMPLE_ACTION, samplePercentage: outOfRange }),
+          LOGS,
+        );
+      }).toThrow(BadDataException);
+    }
+  });
+
+  it("names the allowed range in the message so the fix is obvious", () => {
+    expect(() => {
+      return validateDropFilterSamplePercentage(
+        candidate({ action: SAMPLE_ACTION, samplePercentage: null }),
+        LOGS,
+      );
+    }).toThrow(
+      new RegExp(`${MIN_SAMPLE_PERCENTAGE} and ${MAX_SAMPLE_PERCENTAGE}`),
+    );
+  });
+});
+
+describe("validateDropFilter", () => {
+  it("accepts a well-formed drop filter", () => {
+    expect(() => {
+      return validateDropFilter(
+        candidate({ action: "drop", filterQuery: "severityText = 'Debug'" }),
+        LOGS,
+      );
+    }).not.toThrow();
+  });
+
+  it("accepts a well-formed sample filter", () => {
+    expect(() => {
+      return validateDropFilter(
+        candidate({
+          action: SAMPLE_ACTION,
+          samplePercentage: 10,
+          filterQuery: "severityText = 'Debug'",
+        }),
+        LOGS,
+      );
+    }).not.toThrow();
+  });
+
+  /*
+   * The query check runs first on purpose. A row that is broken both ways
+   * should surface the more destructive problem, because a match-all drop
+   * filter deletes everything while a bad percentage only samples.
+   */
+  it("reports the empty query first when a candidate is broken both ways", () => {
+    expect(() => {
+      return validateDropFilter(
+        candidate({
+          action: SAMPLE_ACTION,
+          samplePercentage: null,
+          filterQuery: "",
+        }),
+        LOGS,
+      );
+    }).toThrow(/Filter query is required/);
+  });
+});
+
+describe("isSqlExpressionValue", () => {
+  /*
+   * `PartialEntity` values may be raw SQL expressions. We cannot evaluate one
+   * to validate it, and stringifying a function to compare it would be worse
+   * than skipping — so the update hook detects and skips.
+   */
+  it("detects a raw SQL expression value", () => {
+    expect(
+      isSqlExpressionValue(() => {
+        return "NOW()";
+      }),
+    ).toBe(true);
+  });
+
+  it("treats every ordinary literal as a plain value", () => {
+    for (const literal of ["sample", "", 0, 50, null, undefined, {}, []]) {
+      expect(isSqlExpressionValue(literal)).toBe(false);
+    }
+  });
+});

package/Tests/Server/Utils/Telemetry/SpanUtil.test.ts

@@ -0,0 +1,94 @@
+import SpanUtil, {
+  SpanAttributes,
+} from "../../../../Server/Utils/Telemetry/SpanUtil";
+import { describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * SpanUtil.addAttributesToSpan copies telemetry attributes onto a span, but it
+ * must drop undefined/null values - OpenTelemetry rejects those and throwing
+ * mid-request would break the traced operation. This pins the filtering so a
+ * partially-populated SpanAttributes object stays safe to pass in.
+ */
+
+// A stand-in Span that just records what setAttribute was called with.
+function fakeSpan(): {
+  span: { setAttribute: (key: string, value: unknown) => void };
+  calls: Array<[string, unknown]>;
+} {
+  const calls: Array<[string, unknown]> = [];
+  const setAttribute: (key: string, value: unknown) => void = jest.fn(
+    (key: string, value: unknown): void => {
+      calls.push([key, value]);
+    },
+  );
+  return { span: { setAttribute }, calls };
+}
+
+describe("SpanUtil.addAttributesToSpan", () => {
+  it("sets every defined attribute on the span", () => {
+    const { span, calls } = fakeSpan();
+
+    const attributes: SpanAttributes = {
+      userId: "user-1",
+      projectId: "project-1",
+    };
+
+    SpanUtil.addAttributesToSpan({
+      span: span as never,
+      attributes,
+    });
+
+    expect(calls).toContainEqual(["userId", "user-1"]);
+    expect(calls).toContainEqual(["projectId", "project-1"]);
+    expect(calls).toHaveLength(2);
+  });
+
+  it("skips undefined and null values (OpenTelemetry rejects them)", () => {
+    const { span, calls } = fakeSpan();
+
+    const attributes: SpanAttributes = {
+      userId: "user-1",
+      projectId: undefined,
+      // null is not part of the typed surface but can arrive at runtime.
+      monitorId: null as unknown as string,
+    };
+
+    SpanUtil.addAttributesToSpan({
+      span: span as never,
+      attributes,
+    });
+
+    expect(calls).toEqual([["userId", "user-1"]]);
+  });
+
+  it("preserves falsy-but-defined values like empty string, 0 and false", () => {
+    const { span, calls } = fakeSpan();
+
+    const attributes: SpanAttributes = {
+      channelId: "",
+      retryCount: 0,
+      isRetry: false,
+    };
+
+    SpanUtil.addAttributesToSpan({
+      span: span as never,
+      attributes,
+    });
+
+    expect(calls).toContainEqual(["channelId", ""]);
+    expect(calls).toContainEqual(["retryCount", 0]);
+    expect(calls).toContainEqual(["isRetry", false]);
+    expect(calls).toHaveLength(3);
+  });
+
+  it("does nothing for an empty attribute object", () => {
+    const { span, calls } = fakeSpan();
+
+    SpanUtil.addAttributesToSpan({
+      span: span as never,
+      attributes: {},
+    });
+
+    expect(calls).toHaveLength(0);
+  });
+});

package/Tests/Types/DateUserTimezone.test.ts

@@ -139,6 +139,58 @@ describe("OneUptimeDate user timezone", () => {
       expect(formatted).toContain("EDT");
     });
 
+    it("names the abbreviation in effect on the formatted date, not today's", () => {
+      OneUptimeDate.setUserTimezone(NY);
+
+      /*
+       * The abbreviation used to be looked up for "now", so all summer every
+       * winter timestamp read "EDT" — and 13:00 EDT is a different instant
+       * than the 13:00 EST that was actually stored.
+       */
+      const winter: string = OneUptimeDate.getDateAsLocalFormattedString(
+        new Date("2026-01-15T18:00:00Z"),
+      );
+      const summer: string = OneUptimeDate.getDateAsLocalFormattedString(
+        new Date("2026-07-15T18:00:00Z"),
+      );
+
+      expect(winter).toContain("13:00");
+      expect(winter).toContain("EST");
+      expect(winter).not.toContain("EDT");
+
+      expect(summer).toContain("14:00");
+      expect(summer).toContain("EDT");
+    });
+
+    it("labels each pass of a folded fall-back hour with its own abbreviation", () => {
+      OneUptimeDate.setUserTimezone(NY);
+
+      // 01:30 local happens twice on 2026-11-01 — once EDT, once EST.
+      const firstPass: string = OneUptimeDate.getDateAsLocalFormattedString(
+        new Date("2026-11-01T05:30:00Z"),
+      );
+      const secondPass: string = OneUptimeDate.getDateAsLocalFormattedString(
+        new Date("2026-11-01T06:30:00Z"),
+      );
+
+      expect(firstPass).toContain("01:30");
+      expect(secondPass).toContain("01:30");
+      // Identical wall clocks; the abbreviation is what tells them apart.
+      expect(firstPass).toContain("EDT");
+      expect(secondPass).toContain("EST");
+    });
+
+    it("still omits the abbreviation when only the date is shown", () => {
+      OneUptimeDate.setUserTimezone(NY);
+
+      const dateOnly: string = OneUptimeDate.getDateAsLocalFormattedString(
+        new Date("2026-01-15T18:00:00Z"),
+        true,
+      );
+
+      expect(dateOnly).toBe("Jan 15, 2026");
+    });
+
     it("reads the hour and minute of an instant in the user timezone", () => {
       OneUptimeDate.setUserTimezone(KOLKATA);
 

package/Tests/Types/Monitor/KubernetesAlertTemplates.test.ts

@@ -7,17 +7,21 @@ import {
 import MonitorStep from "../../../Types/Monitor/MonitorStep";
 import MonitorStepKubernetesMonitor from "../../../Types/Monitor/MonitorStepKubernetesMonitor";
 import MetricsAggregationType from "../../../Types/Metrics/MetricsAggregationType";
+import { FilterType } from "../../../Types/Monitor/CriteriaFilter";
 import ObjectID from "../../../Types/ObjectID";
 
 /*
- * These tests lock in the subtle, easy-to-regress decisions in the per-node
- * ratio alert templates (request utilization + usage utilization):
+ * These tests lock in the subtle, easy-to-regress decisions in the
+ * per-series ratio alert templates (node request/usage utilization, plus
+ * the autoscaling and container-limit saturation templates):
  *
  *   1. Group-by uses the ClickHouse-stored `resource.`-prefixed attribute
  *      name (`resource.k8s.node.name`), not the bare `k8s.node.name`.
  *      OneUptime stamps OTel resource attributes with a `resource.` prefix
  *      at ingest, so the bare key would match nothing and collapse every
- *      node into one mislabeled series.
+ *      node into one mislabeled series. The key differs per template — the
+ *      HPA template groups per HPA and the pod-limit templates per pod —
+ *      so each case carries its own expected key.
  *
  *   2. The aggregation differs by numerator shape:
  *        - Request utilization sums MANY container series per node, and both
@@ -27,9 +31,17 @@ import ObjectID from "../../../Types/ObjectID";
  *          (kubeletstats) and denominator (k8s_cluster) come from different
  *          receivers, so `Avg` on both sides gives the correct per-minute
  *          ratio regardless of each receiver's scrape count.
+ *        - The saturation templates are all `Avg` — see the pod-memory
+ *          template's note in KubernetesAlertTemplates.ts for the
+ *          multi-container trade-off that choice accepts.
  *
  *   3. The criteria reference the FORMULA alias (the computed percentage),
  *      not a raw query alias.
+ *
+ *   4. The unhealthy and healthy criteria PARTITION the value range — no
+ *      gap (a value that matches neither leaves the monitor stuck in its
+ *      previous status) and no overlap (a value that matches both makes the
+ *      resulting status depend on evaluation order).
  */
 
 interface RatioTemplateCase {
@@ -41,6 +53,7 @@ interface RatioTemplateCase {
   resultAlias: string;
   aggregation: MetricsAggregationType;
   threshold: number;
+  groupBy: string;
 }
 
 const RATIO_TEMPLATES: Array<RatioTemplateCase> = [
@@ -54,6 +67,7 @@ const RATIO_TEMPLATES: Array<RatioTemplateCase> = [
     resultAlias: "node_cpu_request_utilization",
     aggregation: MetricsAggregationType.Sum,
     threshold: 90,
+    groupBy: "resource.k8s.node.name",
   },
   {
     id: "k8s-node-memory-request-utilization",
@@ -64,6 +78,7 @@ const RATIO_TEMPLATES: Array<RatioTemplateCase> = [
     resultAlias: "node_memory_request_utilization",
     aggregation: MetricsAggregationType.Sum,
     threshold: 90,
+    groupBy: "resource.k8s.node.name",
   },
   // Usage utilization — Avg/Avg (one series per node, cross-receiver).
   {
@@ -75,6 +90,7 @@ const RATIO_TEMPLATES: Array<RatioTemplateCase> = [
     resultAlias: "node_cpu_utilization",
     aggregation: MetricsAggregationType.Avg,
     threshold: 90,
+    groupBy: "resource.k8s.node.name",
   },
   {
     id: "k8s-high-memory",
@@ -85,6 +101,50 @@ const RATIO_TEMPLATES: Array<RatioTemplateCase> = [
     resultAlias: "node_memory_utilization",
     aggregation: MetricsAggregationType.Avg,
     threshold: 85,
+    groupBy: "resource.k8s.node.name",
+  },
+  /*
+   * Autoscaling / limit saturation — Avg/Avg, and NOT keyed on the node.
+   *
+   * The HPA ratio groups per HPA object; the two pod-limit ratios group
+   * per pod. Locking the group-by key here is the point of these cases:
+   * these were the first ratio templates in this file not keyed on
+   * `resource.k8s.node.name`, so a copy-paste of the node key would
+   * silently collapse every HPA (or every pod) into one mislabeled
+   * series that still renders and still alerts.
+   */
+  {
+    id: "k8s-hpa-at-max-replicas",
+    numerator: "k8s.hpa.current_replicas",
+    denominator: "k8s.hpa.max_replicas",
+    numAlias: "current_replicas",
+    denAlias: "max_replicas",
+    resultAlias: "hpa_replica_saturation",
+    aggregation: MetricsAggregationType.Avg,
+    threshold: 90,
+    groupBy: "resource.k8s.hpa.name",
+  },
+  {
+    id: "k8s-pod-memory-limit-saturation",
+    numerator: "k8s.pod.memory.usage",
+    denominator: "k8s.container.memory_limit",
+    numAlias: "used_mem",
+    denAlias: "limit_mem",
+    resultAlias: "pod_memory_limit_saturation",
+    aggregation: MetricsAggregationType.Avg,
+    threshold: 90,
+    groupBy: "resource.k8s.pod.name",
+  },
+  {
+    id: "k8s-pod-cpu-limit-saturation",
+    numerator: "k8s.pod.cpu.utilization",
+    denominator: "k8s.container.cpu_limit",
+    numAlias: "used_cpu",
+    denAlias: "limit_cpu",
+    resultAlias: "pod_cpu_limit_saturation",
+    aggregation: MetricsAggregationType.Avg,
+    threshold: 90,
+    groupBy: "resource.k8s.pod.name",
   },
 ];
 
@@ -108,8 +168,8 @@ function getKubernetesMonitor(step: MonitorStep): MonitorStepKubernetesMonitor {
   return kubernetesMonitor;
 }
 
-describe("KubernetesAlertTemplates - per-node ratio templates", () => {
-  test("all four ratio templates are registered", () => {
+describe("KubernetesAlertTemplates - per-series ratio templates", () => {
+  test("all ratio templates are registered", () => {
     const ids: Array<string> = getAllKubernetesAlertTemplates().map(
       (t: KubernetesAlertTemplate) => {
         return t.id;
@@ -121,7 +181,7 @@ describe("KubernetesAlertTemplates - per-node ratio templates", () => {
   });
 
   test.each(RATIO_TEMPLATES)(
-    "$id is a per-node ($aggregation/$aggregation) ratio keyed on resource.k8s.node.name",
+    "$id is a ($aggregation/$aggregation) ratio keyed on $groupBy",
     (tc: RatioTemplateCase) => {
       const template: KubernetesAlertTemplate | undefined =
         getKubernetesAlertTemplateById(tc.id);
@@ -162,16 +222,19 @@ describe("KubernetesAlertTemplates - per-node ratio templates", () => {
       );
 
       /*
-       * Decision (1): group by the resource-prefixed node attribute on BOTH
+       * Decision (1): group by the resource-prefixed attribute on BOTH
        * queries so the per-series fingerprints line up for the formula join.
        */
       expect(numerator.metricQueryData.groupByAttributeKeys).toEqual([
-        "resource.k8s.node.name",
+        tc.groupBy,
       ]);
       expect(denominator.metricQueryData.groupByAttributeKeys).toEqual([
-        "resource.k8s.node.name",
+        tc.groupBy,
       ]);
 
+      // The `resource.` prefix is load-bearing — a bare OTel key matches nothing.
+      expect(tc.groupBy.startsWith("resource.")).toBe(true);
+
       // Formula divides numerator by denominator and scales to a percentage.
       expect(formulaConfigs[0].metricFormulaData.metricFormula).toBe(
         `(${tc.numAlias} / ${tc.denAlias}) * 100`,
@@ -190,4 +253,109 @@ describe("KubernetesAlertTemplates - per-node ratio templates", () => {
       expect(offlineFilters[0].value).toBe(tc.threshold);
     },
   );
+
+  /*
+   * Decision (4): unhealthy and healthy must be exact complements at the
+   * same threshold. Both halves are hand-written per template, so the
+   * failure mode is a strict/non-strict slip — pairing `> 90` with
+   * `< 90` leaves exactly 90 matching neither criterion (the monitor
+   * silently holds its previous status), and pairing `>= 90` with
+   * `<= 90` makes 90 match both (status depends on evaluation order).
+   */
+  const COMPLEMENT_OF: Record<string, string> = {
+    [FilterType.GreaterThan]: FilterType.LessThanOrEqualTo,
+    [FilterType.GreaterThanOrEqualTo]: FilterType.LessThan,
+  };
+
+  test.each(RATIO_TEMPLATES)(
+    "$id unhealthy/healthy criteria partition the range at $threshold",
+    (tc: RatioTemplateCase) => {
+      const template: KubernetesAlertTemplate | undefined =
+        getKubernetesAlertTemplateById(tc.id);
+      const step: MonitorStep = template!.getMonitorStep(buildArgs());
+
+      const instances: Array<any> = step.data?.monitorCriteria.data
+        ?.monitorCriteriaInstanceArray as Array<any>;
+      const [offline, online] = instances;
+
+      const offlineFilter: any = offline.data.filters[0];
+      const onlineFilter: any = online.data.filters[0];
+
+      // Same metric, same threshold — only the comparison direction differs.
+      expect(onlineFilter.metricMonitorOptions.metricAlias).toBe(
+        tc.resultAlias,
+      );
+      expect(onlineFilter.value).toBe(tc.threshold);
+
+      expect(COMPLEMENT_OF[offlineFilter.filterType]).toBe(
+        onlineFilter.filterType,
+      );
+
+      // The unhealthy criterion is the one that opens incidents/alerts.
+      expect(offline.data.createIncidents).toBe(true);
+      expect(offline.data.createAlerts).toBe(true);
+      expect(online.data.createIncidents).toBe(false);
+      expect(online.data.createAlerts).toBe(false);
+    },
+  );
+});
+
+/*
+ * The three saturation templates exist to catch the CAUSE of the
+ * "under-resourced workload behind an autoscaler" failure — limits too
+ * low, HPA driven to its ceiling, cluster filled — rather than its
+ * downstream symptoms (node pressure, pending pods, NotReady), which the
+ * older node-side templates already cover. These assertions pin the
+ * properties that make them useful for that: they must be discoverable in
+ * the picker under a category, and severity must reflect that memory
+ * saturation ends in an OOMKill while CPU saturation only throttles.
+ */
+describe("KubernetesAlertTemplates - autoscaling & limit saturation", () => {
+  const SATURATION_TEMPLATES: Array<{
+    id: string;
+    category: string;
+    severity: string;
+  }> = [
+    {
+      id: "k8s-hpa-at-max-replicas",
+      category: "Workload",
+      severity: "Critical",
+    },
+    {
+      id: "k8s-pod-memory-limit-saturation",
+      category: "Workload",
+      // Crossing a memory limit is an immediate kill, not a slowdown.
+      severity: "Critical",
+    },
+    {
+      id: "k8s-pod-cpu-limit-saturation",
+      category: "Workload",
+      // CFS throttling degrades latency; it never kills the container.
+      severity: "Warning",
+    },
+  ];
+
+  test.each(SATURATION_TEMPLATES)(
+    "$id is registered as a $severity $category template",
+    (tc: { id: string; category: string; severity: string }) => {
+      const template: KubernetesAlertTemplate | undefined =
+        getKubernetesAlertTemplateById(tc.id);
+
+      expect(template).toBeDefined();
+      expect(template!.category).toBe(tc.category);
+      expect(template!.severity).toBe(tc.severity);
+      expect(template!.name.length).toBeGreaterThan(0);
+      expect(template!.description.length).toBeGreaterThan(0);
+    },
+  );
+
+  test("every template id is unique", () => {
+    const ids: Array<string> = getAllKubernetesAlertTemplates().map(
+      (t: KubernetesAlertTemplate) => {
+        return t.id;
+      },
+    );
+
+    expect(new Set(ids).size).toBe(ids.length);
+  });
 });