@oneuptime/common 11.7.4 → 12.0.0

package/Tests/Models/DatabaseModels/SessionReplayModels.test.ts

@@ -0,0 +1,447 @@
+import Models from "../../../Models/DatabaseModels/Index";
+import AnalyticsModels from "../../../Models/AnalyticsModels/Index";
+import AnalyticsBaseModel from "../../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
+import AuditLog from "../../../Models/AnalyticsModels/AuditLog";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { PlanType } from "../../../Types/Billing/SubscriptionPlan";
+import Project from "../../../Models/DatabaseModels/Project";
+import RumApplication from "../../../Models/DatabaseModels/RumApplication";
+import RumSessionErasureRequest from "../../../Models/DatabaseModels/RumSessionErasureRequest";
+import RumSessionPin from "../../../Models/DatabaseModels/RumSessionPin";
+import RumSessionReplayView from "../../../Models/DatabaseModels/RumSessionReplayView";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import Dictionary from "../../../Types/Dictionary";
+import { TableColumnMetadata } from "../../../Types/Database/TableColumn";
+import Permission from "../../../Types/Permission";
+import SessionReplayCaptureTrigger from "../../../Types/Rum/SessionReplayCaptureTrigger";
+import SessionReplayConsentMode from "../../../Types/Rum/SessionReplayConsentMode";
+import SessionReplayMaskingMode from "../../../Types/Rum/SessionReplayMaskingMode";
+import { describe, expect, it } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+import { RelationMetadataArgs } from "typeorm/metadata-args/RelationMetadataArgs";
+
+/*
+ * The Postgres side of session replay. Everything asserted here is a
+ * decision that is silently reversible - a default that flips, a cascade
+ * that looks like every other cascade in the codebase, a model that
+ * compiles fine but was never registered - and whose reversal would not
+ * fail a build or a manual test.
+ */
+
+type FindRelationFunction = (
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  target: any,
+  propertyName: string,
+) => RelationMetadataArgs | undefined;
+
+const findRelation: FindRelationFunction = (
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  target: any,
+  propertyName: string,
+): RelationMetadataArgs | undefined => {
+  return getMetadataArgsStorage().relations.find(
+    (relation: RelationMetadataArgs): boolean => {
+      return (
+        relation.target === target && relation.propertyName === propertyName
+      );
+    },
+  );
+};
+
+describe("RumApplication session replay configuration", () => {
+  const model: RumApplication = new RumApplication();
+  const columnNames: Array<string> = model.getTableColumns().columns;
+
+  type GetColumnFunction = (columnName: string) => TableColumnMetadata;
+
+  const getColumn: GetColumnFunction = (
+    columnName: string,
+  ): TableColumnMetadata => {
+    return model.getTableColumnMetadata(columnName);
+  };
+
+  it("declares every session replay configuration column", () => {
+    const expectedColumns: Array<string> = [
+      "isSessionReplayEnabled",
+      "sessionReplayMaskingMode",
+      "sessionReplayMaskSelectors",
+      "sessionReplayBlockSelectors",
+      "sessionReplayAllowedOrigins",
+      "sessionReplayConsentMode",
+      "sessionReplayCaptureTrigger",
+      "sessionReplaySamplePercentage",
+      "sessionReplayCaptureUserIdentity",
+      "sessionReplayCaptureGeo",
+      "sessionReplayRecordCanvas",
+      "sessionReplayRetentionInDays",
+      "sessionReplayMonthlyBudgetInGB",
+      "sessionReplayLastChunkReceivedAt",
+      "sessionReplayBudgetExceededAt",
+    ];
+
+    for (const columnName of expectedColumns) {
+      expect(columnNames).toContain(columnName);
+    }
+  });
+
+  it("is enabled by default, and still captures nothing until something happens", () => {
+    /*
+     * Recording is on out of the box. The thing that keeps that from meaning
+     * "record everyone continuously" is the capture trigger below: sampling
+     * stays at 0, so a session is only uploaded when it actually goes wrong.
+     */
+    expect(getColumn("isSessionReplayEnabled").defaultValue).toBe(true);
+    expect(getColumn("sessionReplaySamplePercentage").defaultValue).toBe(0);
+  });
+
+  it("pins the shipped privacy defaults", () => {
+    /*
+     * This test is a tripwire, not a preference. Masking happens in the
+     * end user's browser before compression, so an under-masked capture
+     * cannot be repaired after the fact - the server never had the
+     * unmasked content. Every value below is a deliberate product
+     * decision about what a customer who configures NOTHING records from
+     * their real users, and changing one should require changing this
+     * test and saying why in the same commit.
+     *
+     * The masking default is MaskSensitiveInputsOnly: passwords and
+     * declared card / one-time-code fields are masked in every mode and
+     * are not configurable, but static page text and ordinary input
+     * values are recorded. That is the trade made to keep recordings
+     * useful to debug from; the two stricter modes and the per-app mask /
+     * block selectors are how a deployment tightens it.
+     */
+    expect(getColumn("sessionReplayMaskingMode").defaultValue).toBe(
+      SessionReplayMaskingMode.MaskSensitiveInputsOnly,
+    );
+    /*
+     * Consent defaults to NotRequired: uploads start without a per-session
+     * grant. A deployment that needs a consent handshake - most EU ones -
+     * must set RequireExplicit per application.
+     */
+    expect(getColumn("sessionReplayConsentMode").defaultValue).toBe(
+      SessionReplayConsentMode.NotRequired,
+    );
+    expect(getColumn("sessionReplayCaptureTrigger").defaultValue).toBe(
+      SessionReplayCaptureTrigger.OnErrorOrFrustration,
+    );
+    /*
+     * Identity and country capture are ON, so a support engineer can find
+     * a named customer's session. Both remain behind the narrower write
+     * ACL asserted below - the default changed, the permission did not.
+     */
+    expect(getColumn("sessionReplayCaptureUserIdentity").defaultValue).toBe(
+      true,
+    );
+    expect(getColumn("sessionReplayCaptureGeo").defaultValue).toBe(true);
+
+    // Canvas stays off: expensive, and the player cannot replay it anyway.
+    expect(getColumn("sessionReplayRecordCanvas").defaultValue).toBe(false);
+  });
+
+  it("defaults replay retention to 7 days, not the 15 the other pillars use", () => {
+    expect(getColumn("sessionReplayRetentionInDays").defaultValue).toBe(7);
+  });
+
+  it("keeps identity and geo capture behind a narrower write ACL than the rest", () => {
+    /*
+     * These two are the switches that turn a pseudonymous recording into
+     * an identified one, so ProjectMember and SettingsMember can read the
+     * setting but must not flip it.
+     */
+    const accessControl: Dictionary<ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    for (const columnName of [
+      "sessionReplayCaptureUserIdentity",
+      "sessionReplayCaptureGeo",
+    ]) {
+      expect(accessControl[columnName]?.update || []).not.toContain(
+        Permission.ProjectMember,
+      );
+      expect(accessControl[columnName]?.update || []).toContain(
+        Permission.ProjectAdmin,
+      );
+    }
+
+    /* And the ordinary settings are editable by the ordinary roles. */
+    expect(accessControl["sessionReplayMaskingMode"]?.update || []).toContain(
+      Permission.EditRumApplication,
+    );
+  });
+
+  it("never exposes the ingest diagnostics as writable", () => {
+    const accessControl: Dictionary<ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    for (const columnName of [
+      "sessionReplayLastChunkReceivedAt",
+      "sessionReplayBudgetExceededAt",
+    ]) {
+      expect(accessControl[columnName]?.create || []).toEqual([]);
+      expect(accessControl[columnName]?.update || []).toEqual([]);
+    }
+  });
+});
+
+describe("Project.isSessionReplayAllowed", () => {
+  const model: Project = new Project();
+
+  it("exists and defaults to on for the whole project", () => {
+    /*
+     * The project-wide switch is the one place to turn session replay off
+     * across every application at once, so it stays a real control even
+     * though it now defaults on.
+     */
+    expect(
+      model.getTableColumnMetadata("isSessionReplayAllowed").defaultValue,
+    ).toBe(true);
+  });
+
+  it("is editable by a project owner or admin", () => {
+    const accessControl: Dictionary<ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    expect(accessControl["isSessionReplayAllowed"]?.update || []).toContain(
+      Permission.ProjectOwner,
+    );
+    expect(accessControl["isSessionReplayAllowed"]?.update || []).toContain(
+      Permission.ProjectAdmin,
+    );
+  });
+});
+
+describe("RumSessionReplayView (read audit)", () => {
+  const model: RumSessionReplayView = new RumSessionReplayView();
+
+  it("is a Postgres model, not a row in the plan-gated AuditLog table", () => {
+    /*
+     * AuditLog is an analytics table gated at PlanType.Enterprise and is
+     * additionally off unless Project.enableAuditLogs is set. If the read
+     * audit lived there, no Free or Growth project - and no project that
+     * never enabled audit logs - would have any record of who watched a
+     * real end user's screen. A privacy control must not be a paid tier.
+     *
+     * So: the alternative really is Enterprise-gated, the replay audit is
+     * not an analytics model, and no column of it carries a billing gate
+     * that would silently reintroduce one.
+     */
+    expect(new AuditLog().tableBillingAccessControl?.read).toBe(
+      PlanType.Enterprise,
+    );
+
+    const analyticsTableNames: Array<string> = AnalyticsModels.map(
+      (analyticsModel: { new (): AnalyticsBaseModel }): string => {
+        return new analyticsModel().tableName || "";
+      },
+    );
+
+    expect(analyticsTableNames).not.toContain("RumSessionReplayView");
+    expect(model.tableName).toBe("RumSessionReplayView");
+
+    for (const columnName of model.getTableColumns().columns) {
+      expect(model.getColumnBillingAccessControl(columnName)).toBeUndefined();
+    }
+  });
+
+  it("cannot be created, updated or deleted through the API", () => {
+    /* Rows are written server-side as root on every playback. */
+    expect(model.createRecordPermissions).toEqual([]);
+    expect(model.updateRecordPermissions).toEqual([]);
+    /* An audit trail somebody can erase is not an audit trail. */
+    expect(model.deleteRecordPermissions).toEqual([]);
+  });
+
+  it("is not readable by every role that can read RUM applications", () => {
+    /*
+     * "Which of my colleagues watched which customer" is itself sensitive,
+     * and Permission.Viewer is the project-wide read-only role.
+     */
+    expect(model.readRecordPermissions).not.toContain(Permission.Viewer);
+    expect(model.readRecordPermissions).not.toContain(Permission.ProjectMember);
+    expect(model.readRecordPermissions).toContain(
+      Permission.ReadRumSessionReplayAudit,
+    );
+  });
+
+  it("records the viewer's own IP, and nothing about the end user's", () => {
+    const columns: Array<string> = model.getTableColumns().columns;
+
+    expect(columns).toContain("ipAddress");
+    expect(columns).toContain("userAgent");
+    expect(columns).toContain("secondsWatched");
+    expect(columns).toContain("accessReason");
+
+    /*
+     * The second half of the title, which is the half that matters. The
+     * recorded person is not a party to this row: it says who watched, not
+     * who was watched. A column carrying the end user's address, location
+     * or identity would turn the privacy control into a second copy of the
+     * data it exists to police.
+     */
+    const endUserLocationPattern: RegExp =
+      /enduser|geo|country|city|latitude|longitude/i;
+
+    const endUserColumn: string | undefined = columns.find(
+      (columnName: string): boolean => {
+        return endUserLocationPattern.test(columnName);
+      },
+    );
+
+    expect(endUserColumn).toBeUndefined();
+
+    /* ipAddress is documented as the viewer's, and nothing disagrees. */
+    expect(model.getTableColumnMetadata("ipAddress").description).toContain(
+      "viewer",
+    );
+  });
+
+  it("keeps the API key id as a bare column so revoking a key does not erase the audit", () => {
+    expect(
+      findRelation(RumSessionReplayView, "viewedByApiKey"),
+    ).toBeUndefined();
+    expect(model.getTableColumns().columns).toContain("viewedByApiKeyId");
+  });
+});
+
+describe("RumSessionErasureRequest", () => {
+  const model: RumSessionErasureRequest = new RumSessionErasureRequest();
+
+  it("nulls out the application relation instead of cascading the request away", () => {
+    /*
+     * THE load-bearing assertion of this file. Every other
+     * rumApplicationId relation in the codebase is ON DELETE CASCADE.
+     * Here that would mean deleting a RUM application also deletes the
+     * erasure request that existed to clean up after it - and since the
+     * recordings live in ClickHouse, untouched by a Postgres cascade, the
+     * end-user data would survive while the instruction to delete it
+     * disappeared.
+     */
+    const relation: RelationMetadataArgs | undefined = findRelation(
+      RumSessionErasureRequest,
+      "rumApplication",
+    );
+
+    expect(relation).toBeDefined();
+    expect(relation?.options.onDelete).toBe("SET NULL");
+    expect(relation?.options.nullable).toBe(true);
+  });
+
+  it("still cascades on project deletion, because a deleted project has nothing to erase", () => {
+    const relation: RelationMetadataArgs | undefined = findRelation(
+      RumSessionErasureRequest,
+      "project",
+    );
+
+    expect(relation?.options.onDelete).toBe("CASCADE");
+  });
+
+  it("cannot have its progress fields rewritten by the requester", () => {
+    /*
+     * A requester who could set status or the deletion counts could make
+     * an erasure that never ran look like one that did.
+     */
+    const accessControl: Dictionary<ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    for (const columnName of [
+      "status",
+      "completedAt",
+      "sessionsDeleted",
+      "chunksDeleted",
+      "failureReason",
+    ]) {
+      expect(accessControl[columnName]?.create || []).toEqual([]);
+      expect(accessControl[columnName]?.update || []).toEqual([]);
+    }
+
+    expect(model.updateRecordPermissions).toEqual([]);
+    expect(model.deleteRecordPermissions).toEqual([]);
+  });
+
+  it("can be raised by a project admin or the granular permission", () => {
+    expect(model.createRecordPermissions).toContain(
+      Permission.CreateRumSessionErasureRequest,
+    );
+    expect(model.readRecordPermissions).toContain(
+      Permission.ReadRumSessionErasureRequest,
+    );
+  });
+});
+
+describe("RumSessionPin", () => {
+  const model: RumSessionPin = new RumSessionPin();
+
+  it("is unique per session, so one recording is never copied twice", () => {
+    const uniqueIndexes: Array<IndexMetadataArgs> =
+      getMetadataArgsStorage().indices.filter(
+        (index: IndexMetadataArgs): boolean => {
+          return index.target === RumSessionPin && index.unique === true;
+        },
+      );
+
+    expect(uniqueIndexes.length).toBe(1);
+    expect(uniqueIndexes[0]?.columns).toEqual([
+      "projectId",
+      "rumApplicationId",
+      "sessionId",
+    ]);
+  });
+
+  it("does not let a client claim the recording has been preserved", () => {
+    /*
+     * materializedAt asserts the session was actually copied out of the
+     * expiring table. A client that could set it would make an
+     * unprotected recording look protected.
+     */
+    const accessControl: Dictionary<ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    expect(accessControl["materializedAt"]?.create || []).toEqual([]);
+    expect(accessControl["materializedAt"]?.update || []).toEqual([]);
+  });
+
+  it("can be removed, so a pin is not a one-way door", () => {
+    expect(model.deleteRecordPermissions).toContain(
+      Permission.DeleteRumSessionReplay,
+    );
+  });
+});
+
+describe("session replay model registration", () => {
+  it("registers all three models in the DatabaseModels index", () => {
+    /*
+     * A model that is not in this array does not exist: TypeORM never sees
+     * the entity, so the table is never created and every query against it
+     * fails at runtime rather than at build time.
+     */
+    const names: Array<string> = Models.map(
+      (model: { new (): BaseModel }): string => {
+        return new model().tableName || "";
+      },
+    );
+
+    expect(names).toContain("RumSessionReplayView");
+    expect(names).toContain("RumSessionErasureRequest");
+    expect(names).toContain("RumSessionPin");
+  });
+
+  it("gives each model its own CRUD route", () => {
+    expect(new RumSessionReplayView().getCrudApiPath()?.toString()).toBe(
+      "/rum-session-replay-view",
+    );
+    expect(new RumSessionErasureRequest().getCrudApiPath()?.toString()).toBe(
+      "/rum-session-erasure-request",
+    );
+    expect(new RumSessionPin().getCrudApiPath()?.toString()).toBe(
+      "/rum-session-pin",
+    );
+  });
+
+  it("scopes all three to a tenant, so one project cannot read another's", () => {
+    expect(new RumSessionReplayView().getTenantColumn()).toBe("projectId");
+    expect(new RumSessionErasureRequest().getTenantColumn()).toBe("projectId");
+    expect(new RumSessionPin().getTenantColumn()).toBe("projectId");
+  });
+});

package/Tests/Models/RunnerVersionLabel.test.ts

@@ -0,0 +1,223 @@
+/*
+ * ---------------------------------------------------------------------------
+ * Runner.agentVersion — the label says "Runner Version", the wire says
+ * "agentVersion", and those two facts must move independently forever.
+ *
+ * The dashboard used to render this field as "Agent Version", which is wrong:
+ * the entity is a Runner, and "agent" is the name of a completely different
+ * family of things in this product (the Host / Docker / Kubernetes / RUM
+ * monitoring agents, which DO have an agent version). Only the display strings
+ * were changed.
+ *
+ * The property name — and therefore the Postgres column, the /api/runner JSON
+ * field, and the POST /heartbeat body key — deliberately stays `agentVersion`:
+ *
+ *   - Runners are customer-pulled containers (`oneuptime/runner:release`) on
+ *     their own upgrade cadence. Weeks of skew against the server is normal.
+ *   - Renaming the key fails SILENTLY. RunnerIngress only writes the column
+ *     when the body carries a non-empty string, so a Runner posting the old key
+ *     to a renamed server still gets HTTP 200, still shows as Connected, and
+ *     just freezes its reported version forever. No exception, no log, no CI
+ *     signal.
+ *   - RunnerService.heartbeat writes through `update["agentVersion"]` on an
+ *     object cast to `never`, so TypeScript would not catch a missed call site.
+ *
+ * So this file pins BOTH halves. The title/description assertions fail if
+ * someone reverts the wording; the property/column assertions fail if someone
+ * "finishes the job" by renaming the field, which is the change that would take
+ * production down quietly. The final describe pins that the eleven unrelated
+ * monitoring-agent models were NOT swept up in the rename.
+ * ---------------------------------------------------------------------------
+ */
+
+import CephCluster from "../../Models/DatabaseModels/CephCluster";
+import CloudResource from "../../Models/DatabaseModels/CloudResource";
+import DockerHost from "../../Models/DatabaseModels/DockerHost";
+import DockerSwarmCluster from "../../Models/DatabaseModels/DockerSwarmCluster";
+import Host from "../../Models/DatabaseModels/Host";
+import IoTFleet from "../../Models/DatabaseModels/IoTFleet";
+import KubernetesCluster from "../../Models/DatabaseModels/KubernetesCluster";
+import PodmanHost from "../../Models/DatabaseModels/PodmanHost";
+import ProxmoxCluster from "../../Models/DatabaseModels/ProxmoxCluster";
+import Runner from "../../Models/DatabaseModels/Runner";
+import RumApplication from "../../Models/DatabaseModels/RumApplication";
+import ServerlessFunction from "../../Models/DatabaseModels/ServerlessFunction";
+import DatabaseBaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { TableColumnMetadata } from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import { describe, expect, test } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import { ColumnMetadataArgs } from "typeorm/metadata-args/ColumnMetadataArgs";
+import fs from "fs";
+import path from "path";
+
+const COLUMN: string = "agentVersion";
+
+const RUNNER_MODEL_PATH: string = path.join(
+  __dirname,
+  "..",
+  "..",
+  "Models",
+  "DatabaseModels",
+  "Runner.ts",
+);
+
+/*
+ * getTableColumns iterates Object.keys(target), which only sees properties
+ * initialized with `= undefined`. It must be given an INSTANCE — passing the
+ * class returns an empty dictionary and every assertion below would pass
+ * vacuously.
+ */
+function metadata(): TableColumnMetadata {
+  return new Runner().getTableColumnMetadata(COLUMN);
+}
+
+function typeOrmColumn(
+  model: new () => DatabaseBaseModel,
+): ColumnMetadataArgs | undefined {
+  return getMetadataArgsStorage().columns.find((column: ColumnMetadataArgs) => {
+    return column.target === model && column.propertyName === COLUMN;
+  });
+}
+
+describe("Runner.agentVersion display label", () => {
+  test("is titled 'Runner Version'", () => {
+    expect(metadata()).toBeDefined();
+    expect(metadata().title).toBe("Runner Version");
+  });
+
+  test("no longer says 'Agent Version' anywhere in its metadata", () => {
+    expect(metadata().title).not.toBe("Agent Version");
+    expect(String(metadata().description)).not.toContain("Agent Version");
+  });
+
+  /*
+   * The description, not the title, is what actually gets published:
+   * ModelSchema prefers description over title when building the Zod
+   * `.describe()` text, and that text is what lands in the generated OpenAPI
+   * spec, the Terraform provider docs and the MCP tool schemas. The API
+   * Reference page renders the description and never renders the title at all.
+   * A title-only fix would have left "agent binary" in every published artifact.
+   */
+  test("describes a Runner binary, not an agent binary", () => {
+    const description: string = String(metadata().description);
+
+    expect(description).toBe(
+      "Self-reported version of the Runner binary. Updated on each heartbeat.",
+    );
+    expect(description).not.toContain("agent binary");
+    expect(description.toLowerCase()).not.toContain("agent");
+  });
+
+  test("still says it is refreshed by the heartbeat", () => {
+    expect(String(metadata().description)).toContain("each heartbeat");
+  });
+});
+
+describe("Runner.agentVersion column contract (must NOT be renamed)", () => {
+  /*
+   * The load-bearing assertion of this whole file. If someone renames the
+   * property to runnerVersion, every deployed Runner keeps POSTing
+   * `agentVersion`, the server quietly ignores it, and the dashboard shows a
+   * connected Runner whose version never advances again.
+   */
+  test("the property is still called agentVersion", () => {
+    expect(new Runner().getTableColumns().columns).toContain(COLUMN);
+    expect(Object.keys(new Runner())).toContain(COLUMN);
+  });
+
+  test("no runnerVersion property was introduced alongside it", () => {
+    expect(new Runner().getTableColumns().columns).not.toContain(
+      "runnerVersion",
+    );
+  });
+
+  test("the Postgres column is still agentVersion and still nullable", () => {
+    const column: ColumnMetadataArgs | undefined = typeOrmColumn(Runner);
+
+    expect(column).toBeDefined();
+    expect(column!.propertyName).toBe(COLUMN);
+    // No `name` override, so TypeORM derives the DB column from the property.
+    expect(column!.options.name).toBeUndefined();
+    expect(column!.options.nullable).toBe(true);
+  });
+
+  test("is still typed as a Version column", () => {
+    expect(metadata().type).toBe(TableColumnType.Version);
+  });
+
+  /*
+   * required: false is what keeps a Runner creatable before it has ever
+   * heartbeated. Flipping it while renaming labels would reject every create.
+   */
+  test("stays optional on create", () => {
+    expect(metadata().required).toBe(false);
+  });
+
+  /*
+   * The rationale for keeping the wire name lives in a comment on the property.
+   * Without it the next reader sees a "Runner Version" label over an
+   * `agentVersion` field and reasonably assumes it was an oversight.
+   */
+  test("carries a comment explaining why the wire name stays agentVersion", () => {
+    const source: string = fs.readFileSync(RUNNER_MODEL_PATH, "utf8");
+    const squashed: string = source.replace(/\s+/g, " ");
+
+    expect(squashed).toContain("the property");
+    expect(squashed).toContain("stays");
+    expect(squashed).toContain("agentVersion");
+    expect(squashed).toContain("un-redeployed Runner");
+  });
+});
+
+/*
+ * The eleven models below are real monitoring agents / SDKs reporting the
+ * version of software OneUptime ships onto a customer host. "Agent Version" is
+ * correct for all of them. A find-and-replace across the repo would have
+ * renamed them too, so each one is pinned by name — a bulk rename fails here
+ * loudly instead of shipping "Runner Version" onto the Kubernetes cluster page.
+ */
+describe("unrelated monitoring-agent models keep saying 'Agent Version'", () => {
+  const AGENT_MODELS: Array<{
+    name: string;
+    model: new () => DatabaseBaseModel;
+  }> = [
+    { name: "Host", model: Host },
+    { name: "DockerHost", model: DockerHost },
+    { name: "PodmanHost", model: PodmanHost },
+    { name: "KubernetesCluster", model: KubernetesCluster },
+    { name: "DockerSwarmCluster", model: DockerSwarmCluster },
+    { name: "CephCluster", model: CephCluster },
+    { name: "ProxmoxCluster", model: ProxmoxCluster },
+    { name: "CloudResource", model: CloudResource },
+    { name: "IoTFleet", model: IoTFleet },
+    { name: "RumApplication", model: RumApplication },
+    { name: "ServerlessFunction", model: ServerlessFunction },
+  ];
+
+  test.each(AGENT_MODELS)(
+    "$name.agentVersion is still titled 'Agent Version'",
+    ({ model }: { model: new () => DatabaseBaseModel }) => {
+      const columnMetadata: TableColumnMetadata =
+        new model().getTableColumnMetadata(COLUMN);
+
+      expect(columnMetadata).toBeDefined();
+      expect(columnMetadata.title).toBe("Agent Version");
+    },
+  );
+
+  test("Runner is the only model of the set that says 'Runner Version'", () => {
+    const runnerVersionTitled: Array<string> = AGENT_MODELS.filter(
+      ({ model }: { model: new () => DatabaseBaseModel }) => {
+        return (
+          new model().getTableColumnMetadata(COLUMN).title === "Runner Version"
+        );
+      },
+    ).map(({ name }: { name: string }) => {
+      return name;
+    });
+
+    expect(runnerVersionTitled).toEqual([]);
+    expect(metadata().title).toBe("Runner Version");
+  });
+});