@oneuptime/common 12.0.12 → 12.0.13

package/Tests/Server/Infrastructure/InMemoryTTLCache.test.ts

@@ -0,0 +1,158 @@
+import InMemoryTTLCache from "../../../Server/Infrastructure/InMemoryTTLCache";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * Contract under test — the bounded TTL cache the telemetry ingest rule
+ * caches (log/trace pipelines, drop filters, scrub rules, metric rules)
+ * sit on. Two properties matter for those callers:
+ *
+ * 1. Expiry physically deletes: a read past the TTL must both miss AND
+ *    shrink the store, or per-project entries accumulate for every tenant
+ *    ever seen by a long-lived ingest process.
+ * 2. Capacity is a hard cap with oldest-write eviction, so the cache can
+ *    never grow past maxEntries no matter how many distinct keys arrive.
+ */
+
+/*
+ * Minimal structural view of a jest spy — the @jest/globals and @types/jest
+ * spy types disagree in this repo, so annotate with just the surface these
+ * tests use.
+ */
+type NowSpyLike = {
+  mockReturnValue: (value: number) => unknown;
+  mockRestore: () => void;
+};
+
+function spyNow(value: number): NowSpyLike {
+  const spy: NowSpyLike = jest.spyOn(Date, "now") as unknown as NowSpyLike;
+  spy.mockReturnValue(value);
+  return spy;
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("InMemoryTTLCache TTL behavior", () => {
+  test("get returns the value within its TTL", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+
+    expect(cache.get("a")).toBe("value-a");
+    expect(cache.has("a")).toBe(true);
+    expect(cache.size()).toBe(1);
+  });
+
+  test("get past the TTL misses AND physically deletes the entry", () => {
+    const t0: number = 1_000_000;
+    const nowSpy: NowSpyLike = spyNow(t0);
+
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+    cache.set("a", "value-a", 1_000);
+    expect(cache.size()).toBe(1);
+
+    // Boundary: at exactly expiresAt the entry is still valid (strict >).
+    nowSpy.mockReturnValue(t0 + 1_000);
+    expect(cache.get("a")).toBe("value-a");
+    expect(cache.size()).toBe(1);
+
+    nowSpy.mockReturnValue(t0 + 1_001);
+    expect(cache.get("a")).toBeUndefined();
+    expect(cache.size()).toBe(0);
+  });
+
+  test("has() reports false for an expired entry and deletes it", () => {
+    const t0: number = 1_000_000;
+    const nowSpy: NowSpyLike = spyNow(t0);
+
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+    cache.set("a", "value-a", 1_000);
+
+    nowSpy.mockReturnValue(t0 + 5_000);
+    expect(cache.has("a")).toBe(false);
+    expect(cache.size()).toBe(0);
+  });
+});
+
+describe("InMemoryTTLCache capacity eviction", () => {
+  test("insert beyond capacity evicts the oldest key", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+    cache.set("b", "value-b", 60_000);
+    cache.set("c", "value-c", 60_000);
+    cache.set("d", "value-d", 60_000);
+
+    expect(cache.size()).toBe(3);
+    expect(cache.get("a")).toBeUndefined();
+    expect(cache.get("b")).toBe("value-b");
+    expect(cache.get("c")).toBe("value-c");
+    expect(cache.get("d")).toBe("value-d");
+  });
+
+  test("re-setting an existing key refreshes insertion order so it is not the eviction victim", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+    cache.set("b", "value-b", 60_000);
+    cache.set("c", "value-c", 60_000);
+
+    // Overwrite at capacity: no eviction, "a" moves to newest position.
+    cache.set("a", "value-a2", 60_000);
+    expect(cache.size()).toBe(3);
+    expect(cache.get("b")).toBe("value-b");
+    expect(cache.get("c")).toBe("value-c");
+
+    // Next new key evicts "b" (now the oldest), not the refreshed "a".
+    cache.set("d", "value-d", 60_000);
+    expect(cache.size()).toBe(3);
+    expect(cache.get("a")).toBe("value-a2");
+    expect(cache.get("b")).toBeUndefined();
+    expect(cache.get("c")).toBe("value-c");
+    expect(cache.get("d")).toBe("value-d");
+  });
+});
+
+describe("InMemoryTTLCache basics", () => {
+  test("values are stored by reference", () => {
+    const cache: InMemoryTTLCache<Array<string>> = new InMemoryTTLCache<
+      Array<string>
+    >(3);
+
+    const value: Array<string> = [];
+    cache.set("a", value, 60_000);
+
+    expect(cache.get("a")).toBe(value);
+  });
+
+  test("delete removes an entry", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+    cache.delete("a");
+
+    expect(cache.get("a")).toBeUndefined();
+    expect(cache.has("a")).toBe(false);
+    expect(cache.size()).toBe(0);
+  });
+
+  test("clear empties the cache", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+    cache.set("b", "value-b", 60_000);
+    cache.clear();
+
+    expect(cache.size()).toBe(0);
+    expect(cache.get("a")).toBeUndefined();
+    expect(cache.get("b")).toBeUndefined();
+  });
+
+  test("has returns false for a key that was never set", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    expect(cache.has("missing")).toBe(false);
+    expect(cache.get("missing")).toBeUndefined();
+  });
+});

package/Tests/Server/Infrastructure/Postgres/DeviceRoleAndDeclaredLinkParentMigration.test.ts

@@ -20,16 +20,14 @@ import { AddDeviceRoleAndDeclaredLinkParent1787400000000 } from "../../../../Ser
  * either would silently restate every device and every link in every
  * project as something an operator had chosen.
  *
- * The second is ORDERING. This is the newest registered migration, so it
- * inherits the guard that used to live in
- * EpisodeMemberNotifyIndexesMigration.test.ts: its timestamp must sort
- * above every other. A migration generated with `generate-postgres-
- * migration` carries a WALL-CLOCK timestamp, and the recent migrations in
- * this repo use hand-picked round numbers that run ahead of it — so the
- * generated file lands below several already-registered migrations unless
- * somebody renumbers it. That is exactly what happened to this one.
- * Whoever adds the next migration should move this test's ordering block
- * to theirs.
+ * The second is REGISTRATION: an import that never reaches the default
+ * export array leaves the migration unregistered, and it silently never
+ * runs.
+ *
+ * The ordering guard this file used to carry — "this is the newest
+ * migration, so its timestamp must sort above every other" — has moved on
+ * to AddNetworkDeviceReachabilityColumnsMigration.test.ts, which is now the
+ * newest. Whoever adds the next migration should move it again.
  */
 
 const MIGRATION_PATH: string = path.join(
@@ -39,15 +37,6 @@ const MIGRATION_PATH: string = path.join(
 
 const SOURCE: string = fs.readFileSync(MIGRATION_PATH, "utf8");
 
-interface MigrationClass {
-  name: string;
-}
-
-function timestampOf(migrationClass: MigrationClass): number | null {
-  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
-  return match ? Number(match[1]) : null;
-}
-
 describe("the columns it adds", () => {
   test("NetworkDevice gains deviceRole", () => {
     expect(SOURCE).toContain(
@@ -190,50 +179,10 @@ describe("the migration runs", () => {
     );
   });
 
-  // The guard described in the header. Hand it to the next migration.
-  test("its timestamp sorts after every other registered migration", () => {
-    const ourTimestamp: number | null = timestampOf(
-      AddDeviceRoleAndDeclaredLinkParent1787400000000,
-    );
-
-    expect(ourTimestamp).not.toBeNull();
-
-    const otherTimestamps: Array<number> = [];
-
-    for (const migrationClass of SchemaMigrations) {
-      if (migrationClass === AddDeviceRoleAndDeclaredLinkParent1787400000000) {
-        continue;
-      }
-
-      const timestamp: number | null = timestampOf(
-        migrationClass as MigrationClass,
-      );
-
-      if (timestamp !== null) {
-        otherTimestamps.push(timestamp);
-      }
-    }
-
-    /*
-     * Math.max() of an empty list is -Infinity, which every timestamp beats.
-     * Prove the list was actually enumerated before leaning on the maximum.
-     */
-    expect(otherTimestamps.length).toBeGreaterThan(100);
-
-    expect(ourTimestamp).toBeGreaterThan(Math.max(...otherTimestamps));
-  });
-
-  test("it is registered last, matching that timestamp", () => {
-    expect(SchemaMigrations[SchemaMigrations.length - 1]).toBe(
-      AddDeviceRoleAndDeclaredLinkParent1787400000000,
-    );
-  });
-
   /*
    * ...and the timestamp in the class name is the one on disk. A class
    * renamed without renaming its file (or two migrations landing on the
-   * same timestamp) leaves the ordering above asserting something that is
-   * not what actually runs.
+   * same timestamp) runs in an order nobody declared.
    */
   test("exactly one file on disk carries its timestamp, and it is this one", () => {
     const directory: string = path.dirname(MIGRATION_PATH);

package/Tests/Server/Middleware/ProjectAuthorizationApiKeyMiddleware.test.ts

@@ -1,4 +1,3 @@
-import APIKeyPermission from "../../../Models/DatabaseModels/ApiKeyPermission";
 import GlobalConfig from "../../../Models/DatabaseModels/GlobalConfig";
 import User from "../../../Models/DatabaseModels/User";
 import ProjectMiddleware from "../../../Server/Middleware/ProjectAuthorization";
@@ -37,6 +36,19 @@ import {
   test,
 } from "@jest/globals";
 
+/*
+ * PasswordHash has a known, pre-existing TS5.9 compile failure under ts-jest
+ * (Buffer vs BinaryLike) that breaks every suite whose import graph reaches
+ * it. Nothing here touches password hashing; stub the module before the
+ * service import graph drags it into compilation.
+ */
+jest.mock("../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: class PasswordHashStub {},
+  };
+});
+
 /*
  * ProjectAuthorization.isValidProjectIdAndApiKeyMiddleware is the single door
  * every API-key request in the product walks through, and it had no test at all.
@@ -67,9 +79,9 @@ describe("ProjectMiddleware.isValidProjectIdAndApiKeyMiddleware", () => {
     ApiKeyService,
     "findApiKey",
   );
-  const spyApiKeyPermissionFindBy: jest.SpyInstance = getJestSpyOn(
+  const spyFindApiKeyPermissions: jest.SpyInstance = getJestSpyOn(
     ApiKeyPermissionService,
-    "findBy",
+    "findPermissionsByApiKeyId",
   );
   const spyGlobalConfigFindOneBy: jest.SpyInstance = getJestSpyOn(
     GlobalConfigService,
@@ -89,7 +101,7 @@ describe("ProjectMiddleware.isValidProjectIdAndApiKeyMiddleware", () => {
     jest.clearAllMocks();
     next = getJestMockFunction();
     spyFindApiKey.mockResolvedValue(null);
-    spyApiKeyPermissionFindBy.mockResolvedValue([]);
+    spyFindApiKeyPermissions.mockResolvedValue([]);
     spyGlobalConfigFindOneBy.mockResolvedValue(null);
     spyUserFindOneBy.mockResolvedValue(null);
   });
@@ -129,16 +141,17 @@ describe("ProjectMiddleware.isValidProjectIdAndApiKeyMiddleware", () => {
     type MockResolvedApiKeyFunction = () => void;
 
     const mockResolvedApiKey: MockResolvedApiKeyFunction = (): void => {
-      const apiKeyPermission: APIKeyPermission = new APIKeyPermission();
-      apiKeyPermission.permission = Permission.ProjectMember;
-      apiKeyPermission.labels = [];
-      apiKeyPermission.isBlockPermission = false;
-
       spyFindApiKey.mockResolvedValue({
         id: apiKeyId,
         projectId: keyProjectId,
       });
-      spyApiKeyPermissionFindBy.mockResolvedValue([apiKeyPermission]);
+      spyFindApiKeyPermissions.mockResolvedValue([
+        {
+          permission: Permission.ProjectMember,
+          labelIds: [],
+          isBlockPermission: false,
+        },
+      ]);
     };
 
     test("should call next with no argument and stamp API identity, tenant and permissions on the request", async () => {
@@ -211,11 +224,7 @@ describe("ProjectMiddleware.isValidProjectIdAndApiKeyMiddleware", () => {
 
       await runMiddleware(req);
 
-      expect(spyApiKeyPermissionFindBy).toHaveBeenCalledWith(
-        expect.objectContaining({
-          query: { apiKeyId: apiKeyId },
-        }),
-      );
+      expect(spyFindApiKeyPermissions).toHaveBeenCalledWith(apiKeyId);
 
       const permissions: Array<UserPermission> =
         (req as OneUptimeRequest).userTenantAccessPermission?.[

package/Tests/Server/Middleware/UserAuthorization.test.ts

@@ -50,6 +50,25 @@ jest.mock("../../../Server/Services/ProjectService");
 jest.mock("../../../Server/Services/TeamMemberService");
 jest.mock("../../../Types/HashedString");
 jest.mock("../../../Types/JSONFunctions");
+/*
+ * PasswordHash carries a pre-existing TS5.9 diagnostic that fails any suite
+ * whose runtime require graph reaches it (DatabaseService, the base class of
+ * every concrete service, imports it). Nothing password-related is under
+ * test here, so the module is replaced WITH A FACTORY — an automock would
+ * still require (and type-check) the real file.
+ */
+jest.mock("../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: {
+      hash: jest.fn(),
+      verify: jest.fn(),
+      generateSalt: jest.fn(),
+      needsUpgrade: jest.fn(),
+      applyPepper: jest.fn(),
+    },
+  };
+});
 
 type StringOrUndefined = string | undefined;
 
@@ -409,6 +428,66 @@ describe("UserMiddleware", () => {
       expect(spyGetUserGlobalAccessPermission).toHaveBeenCalledWith(userId);
     });
 
+    test("should not set global-permissions and global-permissions-hash in the response header, when the global-permissions-hash set in the request header equals the globalPermissionsHash computed from userGlobalAccessPermission", async () => {
+      const mockedRequest: Partial<ExpressRequest> = {
+        headers: { "global-permissions-hash": hashValue },
+      };
+
+      getJestSpyOn(ProjectMiddleware, "getProjectId").mockReturnValueOnce(null);
+      getJestSpyOn(JSONFunctions, "serialize").mockReturnValueOnce({});
+      const spyGetUserGlobalAccessPermission: jest.SpyInstance = getJestSpyOn(
+        AccessTokenService,
+        "getUserGlobalAccessPermission",
+      ).mockResolvedValueOnce(mockedGlobalAccessPermission);
+
+      await UserMiddleware.getUserMiddleware(
+        mockedRequest as ExpressRequest,
+        res,
+        next,
+      );
+
+      expect(res.set).not.toHaveBeenCalledWith(
+        "global-permissions",
+        expect.anything(),
+      );
+      expect(res.set).not.toHaveBeenCalledWith(
+        "global-permissions-hash",
+        expect.anything(),
+      );
+      expect(next).toHaveBeenCalled();
+      expect(spyGetUserGlobalAccessPermission).toHaveBeenCalledWith(userId);
+    });
+
+    test("should set global-permissions and global-permissions-hash in the response header, when the global-permissions-hash set in the request header does not equal the globalPermissionsHash computed from userGlobalAccessPermission", async () => {
+      const mockedRequest: Partial<ExpressRequest> = {
+        headers: { "global-permissions-hash": "different-hash" },
+      };
+
+      getJestSpyOn(ProjectMiddleware, "getProjectId").mockReturnValueOnce(null);
+      getJestSpyOn(JSONFunctions, "serialize").mockReturnValueOnce({});
+      const spyGetUserGlobalAccessPermission: jest.SpyInstance = getJestSpyOn(
+        AccessTokenService,
+        "getUserGlobalAccessPermission",
+      ).mockResolvedValueOnce(mockedGlobalAccessPermission);
+
+      await UserMiddleware.getUserMiddleware(
+        mockedRequest as ExpressRequest,
+        res,
+        next,
+      );
+
+      expect(res.set).toHaveBeenCalledWith(
+        "global-permissions",
+        JSON.stringify({}),
+      );
+      expect(res.set).toHaveBeenCalledWith(
+        "global-permissions-hash",
+        hashValue,
+      );
+      expect(next).toHaveBeenCalled();
+      expect(spyGetUserGlobalAccessPermission).toHaveBeenCalledWith(userId);
+    });
+
     test("should call Response.sendErrorResponse, when tenantId is passed in the header and getUserTenantAccessPermissionWithTenantId throws an exception", async () => {
       const spyGetUserTenantAccessPermissionWithTenantId: jest.SpyInstance =
         getJestSpyOn(