@oneuptime/common 11.7.3 → 12.0.0

package/Tests/Server/Utils/PushNotificationUtil.test.ts

@@ -0,0 +1,228 @@
+import PushNotificationUtil from "../../../Server/Utils/PushNotificationUtil";
+import PushNotificationMessage from "../../../Types/PushNotification/PushNotificationMessage";
+import { describe, expect, test } from "@jest/globals";
+
+describe("PushNotificationUtil", () => {
+  describe("default icon/badge", () => {
+    test("applies the default icon and badge to every notification", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createMonitorCreatedNotification({
+          monitorName: "API",
+          monitorId: "m1",
+        });
+
+      expect(message.icon).toBe(PushNotificationUtil.DEFAULT_ICON);
+      expect(message.badge).toBe(PushNotificationUtil.DEFAULT_BADGE);
+    });
+  });
+
+  describe("createIncidentCreatedNotification", () => {
+    test("includes the display number and identifier when a number is given", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentCreatedNotification({
+          incidentTitle: "DB down",
+          projectName: "Acme",
+          incidentViewLink: "https://x/incident/1",
+          incidentNumber: 42,
+          incidentId: "i1",
+          projectId: "p1",
+        });
+
+      expect(message.title).toBe("New Incident #42: DB down");
+      expect(message.body).toBe(
+        "A new incident has been created: #42 (DB down) in Acme. Click to view details.",
+      );
+      expect(message.tag).toBe("incident-created");
+      expect(message.requireInteraction).toBe(true);
+      expect(message.clickAction).toBe("https://x/incident/1");
+      expect(message.url).toBe("https://x/incident/1");
+      expect(message.data).toMatchObject({
+        type: "incident-created",
+        entityType: "incident",
+        entityId: "i1",
+        projectId: "p1",
+        url: "https://x/incident/1",
+      });
+    });
+
+    test("omits the number when none is provided", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentCreatedNotification({
+          incidentTitle: "DB down",
+          projectName: "Acme",
+          incidentViewLink: "https://x/incident/1",
+        });
+
+      expect(message.title).toBe("New Incident: DB down");
+      expect(message.body).toBe(
+        "A new incident has been created: DB down in Acme. Click to view details.",
+      );
+    });
+
+    test("prefers the prefixed number over the raw number", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentCreatedNotification({
+          incidentTitle: "DB down",
+          projectName: "Acme",
+          incidentViewLink: "https://x/incident/1",
+          incidentNumber: 42,
+          incidentNumberWithPrefix: "INC-42",
+        });
+
+      expect(message.title).toBe("New Incident INC-42: DB down");
+      expect(message.body).toContain("INC-42 (DB down)");
+    });
+  });
+
+  describe("createIncidentStateChangedNotification", () => {
+    test("describes the transition when a previous state is present", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentStateChangedNotification({
+          incidentTitle: "DB down",
+          projectName: "Acme",
+          newState: "Resolved",
+          previousState: "Acknowledged",
+          incidentViewLink: "https://x/incident/1",
+          incidentNumber: 7,
+        });
+
+      expect(message.title).toBe("Incident #7 Updated: DB down");
+      expect(message.body).toBe(
+        "Incident #7 (DB down) state changed from Acknowledged to Resolved in Acme. Click to view details.",
+      );
+      expect(message.data).toMatchObject({
+        newState: "Resolved",
+        previousState: "Acknowledged",
+      });
+    });
+
+    test("omits the previous state when not provided", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentStateChangedNotification({
+          incidentTitle: "DB down",
+          projectName: "Acme",
+          newState: "Resolved",
+          incidentViewLink: "https://x/incident/1",
+        });
+
+      expect(message.body).toBe(
+        "Incident DB down state changed to Resolved in Acme. Click to view details.",
+      );
+    });
+  });
+
+  describe("createMonitorStatusChangedNotification", () => {
+    test("formats title from the new status and body from the transition", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createMonitorStatusChangedNotification({
+          monitorName: "API",
+          projectName: "Acme",
+          newStatus: "Offline",
+          previousStatus: "Online",
+          monitorViewLink: "https://x/monitor/1",
+        });
+
+      expect(message.title).toBe("Monitor Offline: API");
+      expect(message.body).toBe(
+        "Monitor status changed from Online to Offline in Acme. Click to view details.",
+      );
+      expect(message.tag).toBe("monitor-status-changed");
+    });
+  });
+
+  describe("createScheduledMaintenanceNotification", () => {
+    test("lowercases the state inside the body but not the title", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createScheduledMaintenanceNotification({
+          title: "DB upgrade",
+          projectName: "Acme",
+          state: "Started",
+          viewLink: "https://x/sm/1",
+          scheduledMaintenanceNumber: 3,
+        });
+
+      expect(message.title).toBe(
+        "Scheduled Maintenance #3 Started: DB upgrade",
+      );
+      expect(message.body).toBe(
+        "Scheduled maintenance #3 (DB upgrade) started in Acme. Click to view details.",
+      );
+      // Scheduled maintenance is informational, so no forced interaction.
+      expect(message.requireInteraction).toBe(false);
+    });
+  });
+
+  describe("createGenericNotification", () => {
+    test("uses a default tag and no click action when none is given", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createGenericNotification({
+          title: "Hello",
+          body: "World",
+        });
+
+      expect(message.title).toBe("Hello");
+      expect(message.body).toBe("World");
+      expect(message.tag).toBe("OneUptime");
+      expect(message.requireInteraction).toBe(false);
+      expect(message.clickAction).toBeUndefined();
+      expect(message.data).toEqual({ type: "generic" });
+    });
+
+    test("wires clickAction into url and data.url when provided", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createGenericNotification({
+          title: "Hello",
+          body: "World",
+          clickAction: "https://x/go",
+          tag: "custom",
+          requireInteraction: true,
+        });
+
+      expect(message.tag).toBe("custom");
+      expect(message.requireInteraction).toBe(true);
+      expect(message.clickAction).toBe("https://x/go");
+      expect(message.url).toBe("https://x/go");
+      expect(message.data).toMatchObject({
+        type: "generic",
+        url: "https://x/go",
+      });
+    });
+  });
+
+  describe("createProbeDisconnectedNotification", () => {
+    test("builds the fixed probe-disconnected copy", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeDisconnectedNotification({
+          probeName: "edge-1",
+        });
+
+      expect(message.title).toBe("OneUptime: Probe Disconnected");
+      expect(message.body).toBe(
+        "Your probe edge-1 is disconnected. It was last seen 5 minutes ago.",
+      );
+      expect(message.tag).toBe("probe-disconnected");
+      expect(message.data).toMatchObject({
+        type: "probe-disconnected",
+        probeName: "edge-1",
+      });
+    });
+  });
+
+  describe("createAIAgentStatusChangedNotification", () => {
+    test("omits url wiring when no click action is provided", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAIAgentStatusChangedNotification({
+          aiAgentName: "triage-bot",
+          projectName: "Acme",
+          connectionStatus: "Connected",
+        });
+
+      expect(message.title).toBe("AI Agent Connected: triage-bot");
+      expect(message.body).toBe(
+        "AI Agent triage-bot is Connected in Acme. Click to view details.",
+      );
+      expect(message.clickAction).toBeUndefined();
+      expect(message.url).toBeUndefined();
+    });
+  });
+});

package/Tests/Server/Utils/SessionReplay/SessionReplayGateCachePolicy.test.ts

@@ -0,0 +1,177 @@
+import ObjectID from "../../../../Types/ObjectID";
+
+/*
+ * The DB-row -> policy mapping for the Wave 4 columns. Everything else
+ * about the gate cache (invalidation, kill key, fail-closed lookups) has
+ * its own suites; this one pins that the correlation and performance
+ * columns actually reach the policy object - and that a checkout whose
+ * model predates the columns degrades to the feature-off values instead
+ * of exploding, which is the entire reason the columns are read through
+ * an index signature.
+ */
+
+const projectFindOneByMock: jest.Mock = jest.fn();
+const appFindOneByMock: jest.Mock = jest.fn();
+
+jest.mock("../../../../Server/Services/ProjectService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findOneBy: (...args: Array<unknown>): unknown => {
+        return projectFindOneByMock(...args);
+      },
+    },
+  };
+});
+
+jest.mock("../../../../Server/Services/RumApplicationService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findOneBy: (...args: Array<unknown>): unknown => {
+        return appFindOneByMock(...args);
+      },
+    },
+  };
+});
+
+/*
+ * The store is memory+Redis; both sides are irrelevant here, so every
+ * cache read misses and the kill key never fires.
+ */
+jest.mock(
+  "../../../../Server/Utils/SessionReplay/SessionReplayGateCacheStore",
+  () => {
+    return {
+      __esModule: true,
+      POLICY_CACHE_TTL_MS: 60_000,
+      default: {
+        getPolicyEntry: jest.fn().mockReturnValue(undefined),
+        setPolicyEntry: jest.fn(),
+        isProjectKilled: jest.fn().mockResolvedValue(false),
+      },
+    };
+  },
+);
+
+jest.mock("../../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+    },
+  };
+});
+
+import SessionReplayGateCache, {
+  SessionReplayGatePolicy,
+} from "../../../../Server/Utils/SessionReplay/SessionReplayGateCache";
+
+const PROJECT_ID: ObjectID = ObjectID.generate();
+const RUM_APPLICATION_ID: ObjectID = ObjectID.generate();
+
+function projectRow(): unknown {
+  return { isSessionReplayAllowed: true };
+}
+
+function appRow(overrides?: Record<string, unknown>): unknown {
+  return {
+    id: RUM_APPLICATION_ID,
+    isSessionReplayEnabled: true,
+    sessionReplayAllowedOrigins: ["https://shop.example.com"],
+    updatedAt: new Date(1_800_000_000_000),
+    ...overrides,
+  };
+}
+
+describe("SessionReplayGateCache wave 4 policy columns", (): void => {
+  beforeEach((): void => {
+    jest.clearAllMocks();
+    projectFindOneByMock.mockResolvedValue(projectRow());
+  });
+
+  it("maps the correlation and performance columns onto the policy", async (): Promise<void> => {
+    appFindOneByMock.mockResolvedValue(
+      appRow({
+        sessionReplayTracePropagationOrigins: [
+          "https://api.example.com",
+          "https://payments.example.com",
+        ],
+        sessionReplayLcpBudgetMs: 4000,
+        sessionReplayLongTaskBudgetMs: 250,
+        sessionReplaySlowRequestBudgetMs: 6000,
+      }),
+    );
+
+    const policy: SessionReplayGatePolicy | null =
+      await SessionReplayGateCache.getPolicy({
+        projectId: PROJECT_ID,
+        appIdentifier: "checkout-web",
+      });
+
+    expect(policy).not.toBeNull();
+    expect(policy?.tracePropagationOrigins).toEqual([
+      "https://api.example.com",
+      "https://payments.example.com",
+    ]);
+    expect(policy?.lcpBudgetMs).toBe(4000);
+    expect(policy?.longTaskBudgetMs).toBe(250);
+    expect(policy?.slowRequestBudgetMs).toBe(6000);
+  });
+
+  /*
+   * A row from before the migration ran (or a model that predates the
+   * columns): every reader defaults to OFF - empty origins, 0 budgets.
+   */
+  it("degrades to feature-off values when the columns are absent", async (): Promise<void> => {
+    appFindOneByMock.mockResolvedValue(appRow());
+
+    const policy: SessionReplayGatePolicy | null =
+      await SessionReplayGateCache.getPolicy({
+        projectId: PROJECT_ID,
+        appIdentifier: "checkout-web",
+      });
+
+    expect(policy).not.toBeNull();
+    expect(policy?.tracePropagationOrigins).toEqual([]);
+    expect(policy?.lcpBudgetMs).toBe(0);
+    expect(policy?.longTaskBudgetMs).toBe(0);
+    expect(policy?.slowRequestBudgetMs).toBe(0);
+  });
+
+  it("drops non-string entries from the trace origins column", async (): Promise<void> => {
+    appFindOneByMock.mockResolvedValue(
+      appRow({
+        sessionReplayTracePropagationOrigins: [
+          "https://api.example.com",
+          42,
+          null,
+          "",
+        ],
+        sessionReplayLcpBudgetMs: "4000",
+        sessionReplayLongTaskBudgetMs: "not-a-number",
+      }),
+    );
+
+    const policy: SessionReplayGatePolicy | null =
+      await SessionReplayGateCache.getPolicy({
+        projectId: PROJECT_ID,
+        appIdentifier: "checkout-web",
+      });
+
+    expect(policy?.tracePropagationOrigins).toEqual([
+      "https://api.example.com",
+    ]);
+
+    /*
+     * Postgres drivers hand integer columns back as strings in some
+     * configurations, so readNumber coerces numeric strings on purpose -
+     * and anything that does not parse falls back to OFF.
+     */
+    expect(policy?.lcpBudgetMs).toBe(4000);
+    expect(policy?.longTaskBudgetMs).toBe(0);
+  });
+});

package/Tests/Server/Utils/SessionReplay/SessionReplayOriginAllowlist.test.ts

@@ -0,0 +1,108 @@
+import { describe, expect, it } from "@jest/globals";
+import SessionReplayGateCache, {
+  SessionReplayGatePolicy,
+} from "../../../../Server/Utils/SessionReplay/SessionReplayGateCache";
+
+/*
+ * Origin allowlist semantics.
+ *
+ * An empty allowlist means "any origin". That is a deliberate default-on
+ * choice, and it gives something up: TelemetryIngestionKey has no expiry, no
+ * scope and no origin binding, and the install snippet puts it in plain sight
+ * in the customer's browser JavaScript. With the allowlist empty, anyone who
+ * scrapes that key can write forged recordings into the project.
+ *
+ * These tests exist so that trade-off stays explicit rather than becoming an
+ * accident, and so the strict path keeps working once a customer does fill the
+ * allowlist in.
+ */
+
+function buildPolicy(allowedOrigins: Array<string>): SessionReplayGatePolicy {
+  return {
+    allowedOrigins: allowedOrigins,
+  } as unknown as SessionReplayGatePolicy;
+}
+
+describe("SessionReplayGateCache.isOriginAllowed", () => {
+  describe("empty allowlist", () => {
+    it("allows any origin", () => {
+      expect(
+        SessionReplayGateCache.isOriginAllowed(
+          buildPolicy([]),
+          "https://anything.example.com",
+        ),
+      ).toBe(true);
+    });
+
+    it("allows a request with no Origin header at all", () => {
+      /*
+       * Server-to-server posts and some privacy modes send no Origin. With no
+       * allowlist configured there is nothing to check them against.
+       */
+      expect(
+        SessionReplayGateCache.isOriginAllowed(buildPolicy([]), undefined),
+      ).toBe(true);
+    });
+  });
+
+  describe("configured allowlist", () => {
+    const policy: SessionReplayGatePolicy = buildPolicy([
+      "https://app.example.com",
+      "https://www.example.com",
+    ]);
+
+    it("allows a listed origin", () => {
+      expect(
+        SessionReplayGateCache.isOriginAllowed(
+          policy,
+          "https://app.example.com",
+        ),
+      ).toBe(true);
+    });
+
+    it("is case and whitespace insensitive", () => {
+      expect(
+        SessionReplayGateCache.isOriginAllowed(
+          policy,
+          "  HTTPS://APP.EXAMPLE.COM  ",
+        ),
+      ).toBe(true);
+    });
+
+    it("refuses an origin that is not listed", () => {
+      expect(
+        SessionReplayGateCache.isOriginAllowed(
+          policy,
+          "https://evil.example.com",
+        ),
+      ).toBe(false);
+    });
+
+    it("refuses a missing Origin once the customer has configured an allowlist", () => {
+      /*
+       * The permissive branch above applies ONLY to the unconfigured case.
+       * Once origins are named, a request that presents none is refused
+       * rather than waved through - otherwise the allowlist would be trivially
+       * bypassed by omitting a header.
+       */
+      expect(SessionReplayGateCache.isOriginAllowed(policy, undefined)).toBe(
+        false,
+      );
+      expect(SessionReplayGateCache.isOriginAllowed(policy, "")).toBe(false);
+      expect(SessionReplayGateCache.isOriginAllowed(policy, "   ")).toBe(false);
+    });
+
+    it("does not allow a subdomain of a listed origin", () => {
+      /*
+       * Exact-match only. A wildcard would let anyone who can host content on
+       * a customer subdomain forge sessions.
+       */
+      expect(
+        SessionReplayGateCache.isOriginAllowed(
+          policy,
+          "https://evil.app.example.com",
+        ),
+      ).toBe(false);
+    });
+  });
+});