@oneuptime/common 12.0.1 → 12.0.3

package/Tests/Server/API/DashboardPublicResourceListAPI.test.ts

@@ -11,6 +11,7 @@ import IncidentService from "../../../Server/Services/IncidentService";
 import KubernetesResourceService from "../../../Server/Services/KubernetesResourceService";
 import LogService from "../../../Server/Services/LogService";
 import MonitorService from "../../../Server/Services/MonitorService";
+import NetworkSiteService from "../../../Server/Services/NetworkSiteService";
 import PodmanHostService from "../../../Server/Services/PodmanHostService";
 import PodmanResourceService from "../../../Server/Services/PodmanResourceService";
 import ProxmoxResourceService from "../../../Server/Services/ProxmoxResourceService";
@@ -141,6 +142,30 @@ const RESOURCE_CASES: Array<ResourceCase> = [
     nonSelectColumn: "monitorSteps",
     selectKeys: ["_id", "name", "monitorType", "currentMonitorStatus"],
   },
+  {
+    /*
+     * The Network Map draws a FLAT set of pins, so the hierarchy columns
+     * (parentSiteId, materializedPath, depth) are deliberately outside both
+     * the allowlist and the select — structure an anonymous viewer would be
+     * able to walk but the map never shows them.
+     */
+    resourceType: "network-site",
+    componentType: DashboardComponentType.NetworkMap,
+    service: NetworkSiteService,
+    kind: null,
+    allowedQueryKey: "networkSiteTypeId",
+    forbiddenQueryKey: "parentSiteId",
+    selectColumn: "name",
+    nonSelectColumn: "address",
+    selectKeys: [
+      "_id",
+      "name",
+      "networkSiteType",
+      "latitude",
+      "longitude",
+      "currentMonitorStatus",
+    ],
+  },
   {
     resourceType: "host",
     componentType: DashboardComponentType.HostList,
@@ -465,6 +490,7 @@ const ALL_SERVICES: Array<ListService> = [
   IncidentService,
   AlertService,
   MonitorService,
+  NetworkSiteService,
   HostService,
   KubernetesResourceService,
   DockerHostService,

package/Tests/Server/API/TeamMemberRemoveUserFromProjectAPI.test.ts

@@ -0,0 +1,303 @@
+import CommonAPI from "../../../Server/API/CommonAPI";
+import TeamMemberAPI from "../../../Server/API/TeamMemberAPI";
+import TeamMemberService from "../../../Server/Services/TeamMemberService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { mockRouter } from "./Helpers";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Dictionary from "../../../Types/Dictionary";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "@jest/globals";
+
+/*
+ * POST /team-member/remove-user-from-project exists so that removing a person
+ * from a project is ONE server-side delete rather than a DELETE per membership
+ * issued from the browser.
+ *
+ * That distinction is the whole point, and it is invisible from the outside:
+ * TeamMemberService.onBeforeDelete refuses to remove the last accepted member
+ * of a team that shouldHaveAtLeastOneMember (the Owners team), and it refuses
+ * per request. A client-side loop therefore deletes every other membership
+ * first and only then reports the failure, leaving the person stripped of the
+ * teams the admin was just told they had not lost. A single deleteBy runs that
+ * guard across the whole set before deleting anything.
+ *
+ * So these tests pin: one deleteBy, over exactly {userId, projectId}, with the
+ * caller's own permissions (not root), and with the project taken from the
+ * request's tenant rather than from anything the caller put in the body.
+ */
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+  };
+});
+
+const ROUTE: string = "/team-member/remove-user-from-project";
+
+type RouteCallResult = {
+  thrownToNext: unknown;
+  nextCallCount: number;
+};
+
+function buildProps(data: {
+  projectId: ObjectID | undefined;
+  userId: ObjectID;
+}): DatabaseCommonInteractionProps {
+  const memberPermission: UserPermission = {
+    _type: "UserPermission",
+    permission: Permission.ProjectAdmin,
+    labelIds: [],
+  };
+
+  const permissionMap: Dictionary<UserTenantAccessPermission> = {};
+
+  if (data.projectId) {
+    permissionMap[data.projectId.toString()] = {
+      _type: "UserTenantAccessPermission",
+      projectId: data.projectId,
+      permissions: [memberPermission],
+    };
+  }
+
+  return {
+    tenantId: data.projectId,
+    userId: data.userId,
+    userTenantAccessPermission: permissionMap,
+  };
+}
+
+async function callRoute(data: {
+  body: Dictionary<unknown>;
+  authenticatedUserId?: ObjectID | undefined;
+}): Promise<RouteCallResult> {
+  const req: ExpressRequest = {
+    params: {},
+    query: {},
+    body: data.body,
+    headers: {},
+    userAuthorization: data.authenticatedUserId
+      ? { userId: data.authenticatedUserId }
+      : undefined,
+  } as unknown as ExpressRequest;
+
+  const res: ExpressResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+  } as unknown as ExpressResponse;
+
+  const next: jest.Mock = jest.fn();
+
+  await mockRouter
+    .match("POST", ROUTE)
+    .handlerFunction(req, res, next as unknown as NextFunction);
+
+  return {
+    thrownToNext: next.mock.calls[0] ? next.mock.calls[0][0] : undefined,
+    nextCallCount: next.mock.calls.length,
+  };
+}
+
+describe("POST /team-member/remove-user-from-project", () => {
+  let projectId: ObjectID;
+  let callerUserId: ObjectID;
+  let targetUserId: ObjectID;
+  let deleteBySpy: jest.SpyInstance;
+  let propsSpy: jest.SpyInstance;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new TeamMemberAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    projectId = ObjectID.generate();
+    callerUserId = ObjectID.generate();
+    targetUserId = ObjectID.generate();
+
+    deleteBySpy = jest
+      .spyOn(TeamMemberService, "deleteBy")
+      .mockResolvedValue(3);
+
+    propsSpy = jest
+      .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+      .mockResolvedValue(
+        buildProps({ projectId: projectId, userId: callerUserId }),
+      );
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("the route is registered", () => {
+    expect(() => {
+      return mockRouter.match("POST", ROUTE);
+    }).not.toThrow();
+  });
+
+  test("removes every membership in ONE delete, scoped to the user and project", async () => {
+    await callRoute({
+      body: { userId: targetUserId.toString() },
+      authenticatedUserId: callerUserId,
+    });
+
+    expect(deleteBySpy).toHaveBeenCalledTimes(1);
+
+    const deleteBy: {
+      query: Dictionary<unknown>;
+      props: DatabaseCommonInteractionProps;
+    } = deleteBySpy.mock.calls[0]![0] as {
+      query: Dictionary<unknown>;
+      props: DatabaseCommonInteractionProps;
+    };
+
+    expect((deleteBy.query["userId"] as ObjectID).toString()).toBe(
+      targetUserId.toString(),
+    );
+    expect((deleteBy.query["projectId"] as ObjectID).toString()).toBe(
+      projectId.toString(),
+    );
+    // Nothing else narrows it — every team the user is on is in scope.
+    expect(Object.keys(deleteBy.query).sort()).toEqual(["projectId", "userId"]);
+  });
+
+  test("runs the delete with the caller's own permissions, never as root", async () => {
+    await callRoute({
+      body: { userId: targetUserId.toString() },
+      authenticatedUserId: callerUserId,
+    });
+
+    const props: DatabaseCommonInteractionProps = (
+      deleteBySpy.mock.calls[0]![0] as { props: DatabaseCommonInteractionProps }
+    ).props;
+
+    expect(props.isRoot).toBeFalsy();
+    expect(props.userId?.toString()).toBe(callerUserId.toString());
+    expect(props.tenantId?.toString()).toBe(projectId.toString());
+  });
+
+  test("reports how many memberships were removed", async () => {
+    await callRoute({
+      body: { userId: targetUserId.toString() },
+      authenticatedUserId: callerUserId,
+    });
+
+    expect(Response.sendJsonObjectResponse).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      { numberOfMembershipsDeleted: 3 },
+    );
+  });
+
+  test("takes the project from the request's tenant, not from the body", async () => {
+    const attackerSuppliedProjectId: ObjectID = ObjectID.generate();
+
+    await callRoute({
+      body: {
+        userId: targetUserId.toString(),
+        projectId: attackerSuppliedProjectId.toString(),
+      },
+      authenticatedUserId: callerUserId,
+    });
+
+    const query: Dictionary<unknown> = (
+      deleteBySpy.mock.calls[0]![0] as { query: Dictionary<unknown> }
+    ).query;
+
+    expect((query["projectId"] as ObjectID).toString()).toBe(
+      projectId.toString(),
+    );
+    expect((query["projectId"] as ObjectID).toString()).not.toBe(
+      attackerSuppliedProjectId.toString(),
+    );
+  });
+
+  test("rejects an unauthenticated caller without deleting anything", async () => {
+    await callRoute({ body: { userId: targetUserId.toString() } });
+
+    expect(deleteBySpy).not.toHaveBeenCalled();
+    expect(Response.sendErrorResponse).toHaveBeenCalled();
+  });
+
+  test("rejects a request with no tenant without deleting anything", async () => {
+    propsSpy.mockResolvedValue(
+      buildProps({ projectId: undefined, userId: callerUserId }),
+    );
+
+    await callRoute({
+      body: { userId: targetUserId.toString() },
+      authenticatedUserId: callerUserId,
+    });
+
+    expect(deleteBySpy).not.toHaveBeenCalled();
+    expect(Response.sendErrorResponse).toHaveBeenCalled();
+  });
+
+  test("rejects a missing user id without deleting anything", async () => {
+    await callRoute({ body: {}, authenticatedUserId: callerUserId });
+
+    expect(deleteBySpy).not.toHaveBeenCalled();
+    expect(Response.sendErrorResponse).toHaveBeenCalled();
+  });
+
+  test("rejects a user id that is not a uuid without deleting anything", async () => {
+    const result: RouteCallResult = await callRoute({
+      body: { userId: "'; DROP TABLE TeamMember; --" },
+      authenticatedUserId: callerUserId,
+    });
+
+    expect(deleteBySpy).not.toHaveBeenCalled();
+    expect(result.nextCallCount).toBe(1);
+  });
+
+  test("passes a server rejection on rather than reporting success", async () => {
+    /*
+     * This is the last-accepted-Owner guard. It has to reach the caller as a
+     * failure with nothing deleted — which is exactly what the single deleteBy
+     * buys over a per-membership loop.
+     */
+    const guardError: Error = new Error(
+      "This team should have at least 1 member who has accepted the invitation.",
+    );
+
+    deleteBySpy.mockRejectedValue(guardError);
+
+    const result: RouteCallResult = await callRoute({
+      body: { userId: targetUserId.toString() },
+      authenticatedUserId: callerUserId,
+    });
+
+    expect(result.thrownToNext).toBe(guardError);
+    expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Infrastructure/GlobalCache.test.ts

@@ -18,6 +18,7 @@ type MockClient = {
   expire: jest.Mock;
   get: jest.Mock;
   del: jest.Mock;
+  eval: jest.Mock;
 };
 
 describe("GlobalCache.setString", () => {
@@ -29,6 +30,7 @@ describe("GlobalCache.setString", () => {
       expire: jest.fn().mockResolvedValue(1),
       get: jest.fn(),
       del: jest.fn().mockResolvedValue(1),
+      eval: jest.fn().mockResolvedValue(1),
     };
     (Redis.getClient as jest.Mock).mockReturnValue(client);
     (Redis.isConnected as jest.Mock).mockReturnValue(true);
@@ -110,6 +112,7 @@ describe("GlobalCache.deleteKey", () => {
       expire: jest.fn().mockResolvedValue(1),
       get: jest.fn(),
       del: jest.fn().mockResolvedValue(1),
+      eval: jest.fn().mockResolvedValue(1),
     };
     (Redis.getClient as jest.Mock).mockReturnValue(client);
     (Redis.isConnected as jest.Mock).mockReturnValue(true);
@@ -141,3 +144,226 @@ describe("GlobalCache.deleteKey", () => {
     expect(client.del).not.toHaveBeenCalled();
   });
 });
+
+/*
+ * The atomic fence primitives.
+ *
+ * These exist because `getString()` followed by `setString()` is
+ * check-then-act, and the OneUptime ingest path is precisely the workload
+ * that turns that race from theoretical into load-bearing: when thousands of
+ * concurrent jobs across ~100 worker pods resolve the same row in the same
+ * instant, every one of them reads the same miss and every one of them
+ * proceeds. A fence written to admit ONE writer per window admitted all of
+ * them, and the row-lock convoy that followed took production down (1,017
+ * active connections, 892 parked on row locks, the tail waiting 3.7 hours).
+ *
+ * The assertions below are about atomicity — that exactly one Redis command
+ * is issued, and that it carries the NX / compare-and-claim semantics. A
+ * refactor that "simplifies" either of these back into a read plus a write
+ * would keep every other test in the repo passing and reintroduce the outage.
+ */
+describe("GlobalCache.setStringIfNotExists", () => {
+  let client: MockClient;
+
+  beforeEach(() => {
+    client = {
+      set: jest.fn().mockResolvedValue("OK"),
+      expire: jest.fn().mockResolvedValue(1),
+      get: jest.fn(),
+      del: jest.fn().mockResolvedValue(1),
+      eval: jest.fn().mockResolvedValue(1),
+    };
+    (Redis.getClient as jest.Mock).mockReturnValue(client);
+    (Redis.isConnected as jest.Mock).mockReturnValue(true);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test("claims the fence with a single atomic SET ... EX ... NX", async () => {
+    const acquired: boolean = await GlobalCache.setStringIfNotExists(
+      "ns",
+      "key",
+      "1",
+      { expiresInSeconds: 60 },
+    );
+
+    expect(acquired).toBe(true);
+    expect(client.set).toHaveBeenCalledTimes(1);
+    expect(client.set).toHaveBeenCalledWith("ns-key", "1", "EX", 60, "NX");
+    // No read: a GET here would be the check-then-act race coming back.
+    expect(client.get).not.toHaveBeenCalled();
+  });
+
+  test("returns false when another caller already holds the fence", async () => {
+    client.set.mockResolvedValue(null);
+
+    await expect(
+      GlobalCache.setStringIfNotExists("ns", "key", "1", {
+        expiresInSeconds: 60,
+      }),
+    ).resolves.toBe(false);
+  });
+
+  /*
+   * Only a literal "OK" means the key was created. Anything else — a driver
+   * change, a proxy rewriting the reply — must read as "did not acquire":
+   * losing a fence costs one redundant write, wrongly winning one costs the
+   * mutual exclusion the fence exists to provide.
+   */
+  test("treats any non-OK reply as not acquired", async () => {
+    client.set.mockResolvedValue("QUEUED");
+
+    await expect(
+      GlobalCache.setStringIfNotExists("ns", "key", "1"),
+    ).resolves.toBe(false);
+  });
+
+  test("throws when the cache is not connected", async () => {
+    (Redis.isConnected as jest.Mock).mockReturnValue(false);
+
+    await expect(
+      GlobalCache.setStringIfNotExists("ns", "key", "1"),
+    ).rejects.toThrow(DatabaseNotConnectedException);
+    expect(client.set).not.toHaveBeenCalled();
+  });
+
+  test("defaults the TTL to 30 days when no option is passed", async () => {
+    await GlobalCache.setStringIfNotExists("ns", "key", "1");
+
+    expect(client.set).toHaveBeenCalledWith(
+      "ns-key",
+      "1",
+      "EX",
+      OneUptimeDate.getSecondsInDays(30),
+      "NX",
+    );
+  });
+});
+
+describe("GlobalCache.setStringIfChanged", () => {
+  let client: MockClient;
+
+  beforeEach(() => {
+    client = {
+      set: jest.fn().mockResolvedValue("OK"),
+      expire: jest.fn().mockResolvedValue(1),
+      get: jest.fn(),
+      del: jest.fn().mockResolvedValue(1),
+      eval: jest.fn().mockResolvedValue(1),
+    };
+    (Redis.getClient as jest.Mock).mockReturnValue(client);
+    (Redis.isConnected as jest.Mock).mockReturnValue(true);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  /*
+   * Plain NX is the wrong primitive for a fingerprint throttle: it fails
+   * whenever the key exists, including when it holds a STALE fingerprint, so
+   * a genuinely changed payload (a new service.version after a deploy) would
+   * be suppressed for the whole window and never persisted at all.
+   */
+  test("claims the window in one atomic EVAL, with no separate read", async () => {
+    const claimed: boolean = await GlobalCache.setStringIfChanged(
+      "ns",
+      "key",
+      "fingerprint",
+      { expiresInSeconds: 300 },
+    );
+
+    expect(claimed).toBe(true);
+    expect(client.eval).toHaveBeenCalledTimes(1);
+    expect(client.get).not.toHaveBeenCalled();
+    expect(client.set).not.toHaveBeenCalled();
+  });
+
+  test("returns false when the stored value already matches", async () => {
+    client.eval.mockResolvedValue(0);
+
+    await expect(
+      GlobalCache.setStringIfChanged("ns", "key", "fingerprint"),
+    ).resolves.toBe(false);
+  });
+
+  /*
+   * The key must travel as KEYS[1], not be interpolated into the script body
+   * — Redis Cluster routes a script by its declared keys, and an inlined key
+   * makes the script run on an arbitrary node.
+   */
+  test("declares exactly one key, passed as KEYS[1]", async () => {
+    await GlobalCache.setStringIfChanged("ns", "key", "fingerprint", {
+      expiresInSeconds: 300,
+    });
+
+    const args: Array<unknown> = client.eval.mock.calls[0] as Array<unknown>;
+    const script: string = args[0] as string;
+
+    expect(args[1]).toBe(1);
+    expect(args[2]).toBe("ns-key");
+    expect(args[3]).toBe("fingerprint");
+    expect(args[4]).toBe("300");
+    expect(script).toContain("KEYS[1]");
+    expect(script).not.toContain("ns-key");
+  });
+
+  test("throws when the cache is not connected", async () => {
+    (Redis.isConnected as jest.Mock).mockReturnValue(false);
+
+    await expect(
+      GlobalCache.setStringIfChanged("ns", "key", "fingerprint"),
+    ).rejects.toThrow(DatabaseNotConnectedException);
+    expect(client.eval).not.toHaveBeenCalled();
+  });
+});
+
+/*
+ * A fixed TTL lets a fleet-wide event — a deploy, a scale-up, a Redis restart
+ * — align every row's throttle window. They then all expire in the same
+ * second and the herd re-forms on a fixed period, which is the convoy back
+ * again on a timer. Jitter breaks the alignment permanently: windows drift
+ * apart after the first expiry and stay apart.
+ */
+describe("GlobalCache.withJitter", () => {
+  test("never returns less than the requested TTL", () => {
+    for (let i: number = 0; i < 500; i++) {
+      expect(GlobalCache.withJitter(60)).toBeGreaterThanOrEqual(60);
+    }
+  });
+
+  /*
+   * The ceiling is load-bearing. Every markDisconnected* sweep runs at 15
+   * minutes against a 5-minute fence; +25% takes that to 6.25 minutes, still
+   * 2.4x clear. Widening this without re-checking those thresholds would flap
+   * healthy resources between connected and disconnected.
+   */
+  test("never exceeds the requested TTL by more than 25%", () => {
+    for (let i: number = 0; i < 500; i++) {
+      expect(GlobalCache.withJitter(300)).toBeLessThanOrEqual(375);
+    }
+  });
+
+  test("actually spreads values rather than returning a constant", () => {
+    const seen: Set<number> = new Set<number>();
+
+    for (let i: number = 0; i < 200; i++) {
+      seen.add(GlobalCache.withJitter(600));
+    }
+
+    expect(seen.size).toBeGreaterThan(1);
+  });
+
+  test("returns integers — Redis EX rejects fractional seconds", () => {
+    for (let i: number = 0; i < 100; i++) {
+      expect(Number.isInteger(GlobalCache.withJitter(37))).toBe(true);
+    }
+  });
+
+  test("passes through non-positive TTLs unchanged", () => {
+    expect(GlobalCache.withJitter(0)).toBe(0);
+    expect(GlobalCache.withJitter(-1)).toBe(-1);
+  });
+});