@oneuptime/common 11.7.4 → 12.0.1

package/Tests/Server/Utils/CorsOptions.test.ts

@@ -0,0 +1,119 @@
+import { describe, expect, test } from "@jest/globals";
+import cors from "cors";
+import CorsOptions from "../../../Server/Utils/CorsOptions";
+
+/*
+ * A REAL preflight through the real cors middleware.
+ *
+ * The test this replaces read StartServer.ts as text and asserted it
+ * CONTAINED "x-oneuptime-token", the app-identifier header name and
+ * "Access-Control-Max-Age" - all three of which also appear in the
+ * explanatory comment block directly above the code, so it passed with the
+ * header edits reverted and only the prose kept. It also proved nothing
+ * about the preflight, which never reaches setDefaultHeaders at all: cors
+ * 2.8.5 defaults preflightContinue to false, so it answers OPTIONS itself
+ * and calls res.end() before any later middleware runs.
+ */
+
+interface CorsProbeResult {
+  headers: Record<string, string>;
+  nextCalled: boolean;
+}
+
+function runCors(method: string): CorsProbeResult {
+  const headers: Record<string, string> = {};
+
+  const req: unknown = {
+    method: method,
+    headers: {
+      origin: "https://shop.example.com",
+      "access-control-request-method": "POST",
+      "access-control-request-headers": "content-type, x-oneuptime-token",
+    },
+  };
+
+  let nextCalled: boolean = false;
+
+  const res: unknown = {
+    statusCode: 200,
+    setHeader: (name: string, value: string | Array<string>): void => {
+      headers[name] = Array.isArray(value) ? value.join(", ") : String(value);
+    },
+    getHeader: (name: string): string | undefined => {
+      return headers[name];
+    },
+    end: (): void => {
+      /* Preflight short-circuit. */
+    },
+  };
+
+  cors(CorsOptions)(
+    req as never,
+    res as never,
+    ((): void => {
+      nextCalled = true;
+    }) as never,
+  );
+
+  return { headers: headers, nextCalled: nextCalled };
+}
+
+describe("CORS preflight and exposed headers", () => {
+  test("a preflight carries Access-Control-Max-Age", () => {
+    /*
+     * Without it the browser falls back to its own default preflight cache
+     * (5 seconds in Chrome), which would preflight very nearly every replay
+     * chunk flush - doubling the request count on the highest-volume browser
+     * endpoint we have.
+     */
+    const result: CorsProbeResult = runCors("OPTIONS");
+
+    expect(result.headers["Access-Control-Max-Age"]).toBe("86400");
+  });
+
+  test("a preflight is answered by cors itself, never by a later middleware", () => {
+    const result: CorsProbeResult = runCors("OPTIONS");
+
+    /*
+     * This is precisely why Max-Age has to be a cors OPTION and not a header
+     * written in setDefaultHeaders, which is registered after cors.
+     */
+    expect(result.nextCalled).toBe(false);
+  });
+
+  test("the replay stand-down headers are exposed to a cross-origin recorder", () => {
+    const result: CorsProbeResult = runCors("POST");
+
+    const exposed: string = (
+      result.headers["Access-Control-Expose-Headers"] || ""
+    ).toLowerCase();
+
+    /*
+     * Only the CORS-safelisted response headers are readable from another
+     * origin, and the recorder runs on the customer's own origin. Without
+     * these three it sees a bodyless 204 with no directive (removing the only
+     * fast path for the kill switch) and a 429 with no Retry-After.
+     */
+    expect(exposed).toContain("x-oneuptime-replay-directive");
+    expect(exposed).toContain("x-oneuptime-replay-config-epoch");
+    /*
+     * The WHY behind a stand-down. The 204 stop path has no body, so the
+     * reason exists only as this header — unexposed, it is unreadable by
+     * every cross-origin page and the reason channel is dead on arrival.
+     */
+    expect(exposed).toContain("x-oneuptime-replay-reason");
+    expect(exposed).toContain("retry-after");
+  });
+
+  test("allowedHeaders is left to the cors default, which reflects the request", () => {
+    const result: CorsProbeResult = runCors("OPTIONS");
+
+    /*
+     * Pinning an explicit list would silently break the first client that
+     * starts sending a new header. Reflection cannot go stale.
+     */
+    expect(result.headers["Access-Control-Allow-Headers"]).toBe(
+      "content-type, x-oneuptime-token",
+    );
+  });
+});

package/Tests/Server/Utils/Database/RelationIdUtil.test.ts

@@ -0,0 +1,120 @@
+import RelationIdUtil from "../../../../Server/Utils/Database/RelationIdUtil";
+import ObjectID from "../../../../Types/ObjectID";
+
+/*
+ * Contract under test: a many-to-one reference reaches a service hook under
+ * two spellings - the FK column (`siteId`, written by server-side callers)
+ * and the serialised relation (`site`, which is what the dashboard's forms
+ * post). Hooks that watched only one of them silently ignored every write
+ * made through the other (OneUptime/oneuptime#2940).
+ */
+
+const SITE_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const OTHER_SITE_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+
+const SITE_KEYS: Array<string> = ["siteId", "site"];
+
+describe("RelationIdUtil.isWritten", () => {
+  it("sees the FK column", () => {
+    expect(RelationIdUtil.isWritten(["siteId", "name"], SITE_KEYS)).toBe(true);
+  });
+
+  it("sees the relation key", () => {
+    expect(RelationIdUtil.isWritten(["site", "name"], SITE_KEYS)).toBe(true);
+  });
+
+  it("sees a key even when its value clears the reference", () => {
+    expect(RelationIdUtil.isWritten(["site"], SITE_KEYS)).toBe(true);
+  });
+
+  it("ignores payloads that touch neither", () => {
+    expect(
+      RelationIdUtil.isWritten(["name", "hostname", "sysName"], SITE_KEYS),
+    ).toBe(false);
+    expect(RelationIdUtil.isWritten([], SITE_KEYS)).toBe(false);
+  });
+
+  it("does not match a similarly named key", () => {
+    expect(RelationIdUtil.isWritten(["parentSiteId"], SITE_KEYS)).toBe(false);
+  });
+});
+
+describe("RelationIdUtil.read", () => {
+  it("reads an ObjectID from the FK column", () => {
+    const id: ObjectID | null = RelationIdUtil.read(
+      { siteId: SITE_ID },
+      SITE_KEYS,
+    );
+    expect(id?.toString()).toBe(SITE_ID.toString());
+  });
+
+  it("reads a plain id string from the FK column", () => {
+    const id: ObjectID | null = RelationIdUtil.read(
+      { siteId: SITE_ID.toString() },
+      SITE_KEYS,
+    );
+    expect(id?.toString()).toBe(SITE_ID.toString());
+  });
+
+  it("reads _id out of a serialised relation", () => {
+    const id: ObjectID | null = RelationIdUtil.read(
+      { site: { _id: SITE_ID.toString(), name: "WB Unit 0664" } },
+      SITE_KEYS,
+    );
+    expect(id?.toString()).toBe(SITE_ID.toString());
+  });
+
+  it("reads id out of a hydrated relation", () => {
+    const id: ObjectID | null = RelationIdUtil.read(
+      { site: { id: SITE_ID } },
+      SITE_KEYS,
+    );
+    expect(id?.toString()).toBe(SITE_ID.toString());
+  });
+
+  it("prefers the FK column when a payload carries both", () => {
+    const id: ObjectID | null = RelationIdUtil.read(
+      { siteId: SITE_ID, site: { _id: OTHER_SITE_ID.toString() } },
+      SITE_KEYS,
+    );
+    expect(id?.toString()).toBe(SITE_ID.toString());
+  });
+
+  it("falls through an empty FK column to the relation", () => {
+    const id: ObjectID | null = RelationIdUtil.read(
+      { siteId: null, site: { _id: OTHER_SITE_ID.toString() } },
+      SITE_KEYS,
+    );
+    expect(id?.toString()).toBe(OTHER_SITE_ID.toString());
+  });
+
+  it("returns null when the reference is being cleared", () => {
+    expect(RelationIdUtil.read({ siteId: null }, SITE_KEYS)).toBeNull();
+    expect(RelationIdUtil.read({ site: null }, SITE_KEYS)).toBeNull();
+    expect(RelationIdUtil.read({ siteId: "" }, SITE_KEYS)).toBeNull();
+  });
+
+  it("returns null for a relation object with no id in it", () => {
+    expect(
+      RelationIdUtil.read({ site: { name: "WB Unit 0664" } }, SITE_KEYS),
+    ).toBeNull();
+    expect(RelationIdUtil.read({ site: {} }, SITE_KEYS)).toBeNull();
+  });
+
+  it("returns null when the payload does not mention the reference", () => {
+    expect(RelationIdUtil.read({ name: "Core Switch" }, SITE_KEYS)).toBeNull();
+    expect(RelationIdUtil.read({}, SITE_KEYS)).toBeNull();
+    expect(RelationIdUtil.read(null, SITE_KEYS)).toBeNull();
+    expect(RelationIdUtil.read(undefined, SITE_KEYS)).toBeNull();
+  });
+
+  it("works for any reference, not just sites", () => {
+    const id: ObjectID | null = RelationIdUtil.read(
+      { parentSite: { _id: SITE_ID.toString() } },
+      ["parentSiteId", "parentSite"],
+    );
+    expect(id?.toString()).toBe(SITE_ID.toString());
+  });
+});

package/Tests/Server/Utils/Database/ResolveReferenceId.test.ts

@@ -0,0 +1,60 @@
+import { resolveReferenceId } from "../../../../Server/Utils/Database/ProjectScopedReferenceValidator";
+import ObjectID from "../../../../Types/ObjectID";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * resolveReferenceId feeds the project-scoped FK guard in every create/update
+ * hook that carries a cross-project reference (incident state/severity, monitor
+ * status, etc.). The same logical reference arrives in several shapes, and the
+ * guard silently passes (letting a foreign-project id persist, which then makes
+ * that project undeletable) if any shape is read wrong. These tests pin every
+ * shape the resolver must understand — especially the bare-uuid-string relation
+ * slot, which only becomes a relation entity AFTER onBeforeUpdate runs, so the
+ * naive `value?._id` read would miss it.
+ */
+
+describe("resolveReferenceId", () => {
+  it("returns undefined for null/undefined/empty inputs", () => {
+    expect(resolveReferenceId(undefined)).toBeUndefined();
+    expect(resolveReferenceId(null)).toBeUndefined();
+    expect(resolveReferenceId("")).toBeUndefined();
+  });
+
+  it("returns a bare uuid string as-is (the update-path relation slot)", () => {
+    const uuid: string = "c3d4e5f6-a7b8-9012-cdef-345678901234";
+
+    expect(resolveReferenceId(uuid)).toBe(uuid);
+  });
+
+  it("returns an ObjectID instance unchanged", () => {
+    const id: ObjectID = ObjectID.generate();
+
+    expect(resolveReferenceId(id)).toBe(id);
+  });
+
+  it("reads the _id string off a relation object", () => {
+    const uuid: string = ObjectID.generate().toString();
+
+    expect(resolveReferenceId({ _id: uuid })).toBe(uuid);
+  });
+
+  it("reads the id member off a relation object when _id is absent", () => {
+    const id: ObjectID = ObjectID.generate();
+
+    expect(resolveReferenceId({ id })).toBe(id);
+  });
+
+  it("prefers _id over id when a relation object carries both", () => {
+    const idMember: ObjectID = ObjectID.generate();
+    const underscoreId: string = ObjectID.generate().toString();
+
+    expect(resolveReferenceId({ _id: underscoreId, id: idMember })).toBe(
+      underscoreId,
+    );
+  });
+
+  it("returns undefined for a relation object that carries neither _id nor id", () => {
+    expect(resolveReferenceId({})).toBeUndefined();
+    expect(resolveReferenceId({ name: "not a reference" })).toBeUndefined();
+  });
+});

package/Tests/Server/Utils/InstanceHealth/PostgresHealth.test.ts

@@ -0,0 +1,337 @@
+import PostgresAppInstance from "../../../../Server/Infrastructure/PostgresDatabase";
+import {
+  getPostgresHealthSnapshot,
+  gigabytesToBytes,
+  PostgresHealthSnapshot,
+  POSTGRES_WRAPAROUND_CEILING,
+} from "../../../../Server/Utils/InstanceHealth/PostgresHealth";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Each probe is a separate query, so the fake data source dispatches on a
+ * recognisable fragment of each statement. That lets a single test fail one
+ * probe while the rest keep answering, which is exactly the partial-failure
+ * behaviour the snapshot is built to survive.
+ */
+function makeDataSource(overrides: Record<string, unknown> = {}): {
+  query: jest.Mock;
+} {
+  const responses: Record<string, unknown> = {
+    recovery: [{ in_recovery: false }],
+    size: [{ size: "53687091200" }],
+    wal: [{ size: "1073741824" }],
+    connections: [
+      { max_connections: "100", reserved_connections: "3", backends: "40" },
+    ],
+    wraparound: [{ max_xid_age: "1073741824", max_mxid_age: "1000" }],
+    slots: [],
+    ...overrides,
+  };
+
+  return {
+    query: jest.fn(async (sql: string): Promise<unknown> => {
+      if (sql.includes("pg_is_in_recovery() AS in_recovery")) {
+        return unwrap(responses["recovery"]);
+      }
+      if (sql.includes("pg_ls_waldir")) {
+        return unwrap(responses["wal"]);
+      }
+      if (sql.includes("pg_database_size")) {
+        return unwrap(responses["size"]);
+      }
+      if (sql.includes("max_connections")) {
+        return unwrap(responses["connections"]);
+      }
+      if (sql.includes("datfrozenxid")) {
+        return unwrap(responses["wraparound"]);
+      }
+      if (sql.includes("pg_replication_slots")) {
+        // wal_status did not exist before PG 13; the probe retries without it.
+        if (sql.includes("COALESCE(wal_status")) {
+          return unwrap(responses["slots"]);
+        }
+        return unwrap(responses["slotsWithoutWalStatus"] ?? responses["slots"]);
+      }
+      throw new Error(`Unexpected query: ${sql}`);
+    }),
+  };
+}
+
+function unwrap(response: unknown): unknown {
+  if (response instanceof Error) {
+    throw response;
+  }
+  return response;
+}
+
+function connect(dataSource: { query: jest.Mock }): void {
+  jest
+    .spyOn(PostgresAppInstance, "getDataSource")
+    .mockReturnValue(dataSource as never);
+}
+
+describe("PostgresHealth", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("gigabytesToBytes converts using binary gigabytes", () => {
+    expect(gigabytesToBytes(1)).toBe(1073741824);
+    expect(gigabytesToBytes(10)).toBe(10737418240);
+    expect(gigabytesToBytes(0)).toBe(0);
+  });
+
+  test("the wraparound ceiling is 2^31", () => {
+    expect(POSTGRES_WRAPAROUND_CEILING).toBe(2 ** 31);
+  });
+
+  test("returns null when Postgres is not connected", async () => {
+    jest.spyOn(PostgresAppInstance, "getDataSource").mockReturnValue(null);
+
+    expect(await getPostgresHealthSnapshot()).toBeNull();
+  });
+
+  test("reads every probe into one snapshot", async () => {
+    connect(
+      makeDataSource({
+        slots: [
+          {
+            slot_name: "replica_1",
+            slot_type: "physical",
+            active: true,
+            wal_status: "reserved",
+            retained_bytes: "1073741824",
+          },
+        ],
+      }),
+    );
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.isInRecovery).toBe(false);
+    expect(snapshot?.databaseSizeInBytes).toBe(53687091200);
+    expect(snapshot?.walSizeInBytes).toBe(1073741824);
+    expect(snapshot?.maxConnections).toBe(100);
+    // max_connections minus the reserved slots ordinary clients cannot use.
+    expect(snapshot?.usableConnections).toBe(97);
+    expect(snapshot?.clientBackends).toBe(40);
+    expect(snapshot?.connectionUtilizationPercent).toBeCloseTo(
+      (40 / 97) * 100,
+      5,
+    );
+    expect(snapshot?.maxTransactionIdAge).toBe(1073741824);
+    expect(snapshot?.wraparoundUtilizationPercent).toBeCloseTo(50, 5);
+    expect(snapshot?.replicationSlots).toEqual([
+      {
+        slotName: "replica_1",
+        slotType: "physical",
+        isActive: true,
+        walStatus: "reserved",
+        retainedWalInBytes: 1073741824,
+      },
+    ]);
+  });
+
+  test("recognises a standby", async () => {
+    connect(makeDataSource({ recovery: [{ in_recovery: true }] }));
+
+    expect((await getPostgresHealthSnapshot())?.isInRecovery).toBe(true);
+  });
+
+  test("maps a null retained_bytes to unknown rather than zero", async () => {
+    connect(
+      makeDataSource({
+        recovery: [{ in_recovery: true }],
+        slots: [
+          {
+            slot_name: "replica_1",
+            slot_type: "physical",
+            active: false,
+            wal_status: "reserved",
+            retained_bytes: null,
+          },
+        ],
+      }),
+    );
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.replicationSlots?.[0]?.retainedWalInBytes).toBeNull();
+  });
+
+  test("defaults a missing wal_status to unknown", async () => {
+    connect(
+      makeDataSource({
+        slots: [
+          {
+            slot_name: "replica_1",
+            slot_type: null,
+            active: false,
+            wal_status: null,
+            retained_bytes: "0",
+          },
+        ],
+      }),
+    );
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.replicationSlots?.[0]?.walStatus).toBe("unknown");
+    expect(snapshot?.replicationSlots?.[0]?.slotType).toBe("unknown");
+  });
+
+  /*
+   * A failed slot probe must be distinguishable from an instance that genuinely
+   * has no slots: the first is unknown, the second is healthy, and the caller
+   * resolves an open notification on one but not the other. Both the initial
+   * query and the no-wal_status retry fail here.
+   */
+  test("keeps the other probes when the replication-slot probe fails", async () => {
+    connect(
+      makeDataSource({
+        slots: new Error("column wal_status does not exist"),
+      }),
+    );
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.replicationSlots).toBeNull();
+    expect(snapshot?.databaseSizeInBytes).toBe(53687091200);
+    expect(snapshot?.connectionUtilizationPercent).toBeCloseTo(
+      (40 / 97) * 100,
+      5,
+    );
+  });
+
+  test("reports an empty list when the instance has no replication slots", async () => {
+    connect(makeDataSource({ slots: [] }));
+
+    expect((await getPostgresHealthSnapshot())?.replicationSlots).toEqual([]);
+  });
+
+  test("keeps the other probes when the size probe fails", async () => {
+    connect(makeDataSource({ size: new Error("permission denied") }));
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.databaseSizeInBytes).toBeNull();
+    expect(snapshot?.maxConnections).toBe(100);
+  });
+
+  test("keeps the other probes when the connection probe fails", async () => {
+    connect(makeDataSource({ connections: new Error("permission denied") }));
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.maxConnections).toBeNull();
+    expect(snapshot?.clientBackends).toBeNull();
+    expect(snapshot?.connectionUtilizationPercent).toBeNull();
+    expect(snapshot?.databaseSizeInBytes).toBe(53687091200);
+  });
+
+  test("keeps the other probes when the wraparound probe fails", async () => {
+    connect(makeDataSource({ wraparound: new Error("permission denied") }));
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.maxTransactionIdAge).toBeNull();
+    expect(snapshot?.wraparoundUtilizationPercent).toBeNull();
+    expect(snapshot?.databaseSizeInBytes).toBe(53687091200);
+  });
+
+  test("reports no connection ratio when max_connections is unreadable", async () => {
+    connect(
+      makeDataSource({
+        connections: [
+          { max_connections: null, reserved_connections: "3", backends: "40" },
+        ],
+      }),
+    );
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.maxConnections).toBeNull();
+    expect(snapshot?.usableConnections).toBeNull();
+    expect(snapshot?.connectionUtilizationPercent).toBeNull();
+  });
+
+  /*
+   * Multixact age is an independent counter with the same ceiling and the same
+   * shutdown. An FK-heavy workload can exhaust it while ordinary XID age still
+   * looks fine, so the check has to report whichever is worse.
+   */
+  test("reports the worse of transaction-ID and multixact age", async () => {
+    connect(
+      makeDataSource({
+        wraparound: [{ max_xid_age: "1000", max_mxid_age: "1610612736" }],
+      }),
+    );
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.transactionIdAge).toBe(1000);
+    expect(snapshot?.multiXactIdAge).toBe(1610612736);
+    expect(snapshot?.maxTransactionIdAge).toBe(1610612736);
+    expect(snapshot?.wraparoundUtilizationPercent).toBeCloseTo(75, 5);
+  });
+
+  test("leaves WAL size unmeasured when pg_ls_waldir is not permitted", async () => {
+    connect(makeDataSource({ wal: new Error("permission denied") }));
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.walSizeInBytes).toBeNull();
+    expect(snapshot?.databaseSizeInBytes).toBe(53687091200);
+  });
+
+  /*
+   * wal_status arrived in PG 13. On an older external database the column does
+   * not exist and the statement errors, which would silence the slot check
+   * entirely even though retained-WAL detection works fine there.
+   */
+  test("retries without wal_status when the column does not exist", async () => {
+    connect(
+      makeDataSource({
+        slots: new Error('column "wal_status" does not exist'),
+        slotsWithoutWalStatus: [
+          {
+            slot_name: "replica_1",
+            slot_type: "physical",
+            active: false,
+            wal_status: "unknown",
+            retained_bytes: "2147483648",
+          },
+        ],
+      }),
+    );
+
+    const snapshot: PostgresHealthSnapshot | null =
+      await getPostgresHealthSnapshot();
+
+    expect(snapshot?.replicationSlots).toEqual([
+      {
+        slotName: "replica_1",
+        slotType: "physical",
+        isActive: false,
+        walStatus: "unknown",
+        retainedWalInBytes: 2147483648,
+      },
+    ]);
+  });
+
+  test("handles an empty result row from a probe", async () => {
+    connect(makeDataSource({ size: [] }));
+
+    expect((await getPostgresHealthSnapshot())?.databaseSizeInBytes).toBeNull();
+  });
+});