@oneuptime/common 12.0.12 → 12.0.13

package/Tests/Server/Services/AddNetworkDeviceReachabilityColumnsMigration.test.ts

@@ -0,0 +1,332 @@
+import { AddNetworkDeviceReachabilityColumns1787600000000 } from "../../../Server/Infrastructure/Postgres/SchemaMigrations/1787600000000-AddNetworkDeviceReachabilityColumns";
+import SchemaMigrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import NetworkDevice from "../../../Models/DatabaseModels/NetworkDevice";
+import { MigrationInterface, QueryRunner } from "typeorm";
+import fs from "fs";
+import path from "path";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The migration behind the reachability fix (issue #3220).
+ *
+ * Reachability moved from "lastSeenAt is recent" to "the last poll
+ * succeeded", which needs two new columns. Four things have to hold or a
+ * deployed instance is worse off than before the fix:
+ *
+ *   1. up() adds exactly lastPolledAt and isReachable, both nullable —
+ *      NULL is the "never polled" state the UI renders as Pending, so a
+ *      NOT NULL column or a default would put every existing device into a
+ *      real verdict it has not earned;
+ *   2. it backfills existing rows, because an unbackfilled fleet would read
+ *      as entirely Pending on the first page load after an upgrade — every
+ *      device gone from both the Up and Down lists;
+ *   3. down() removes exactly what up() added;
+ *   4. the migration is registered in SchemaMigrations/Index.ts. An
+ *      unregistered migration never runs on boot, so the columns would be
+ *      missing while every read and the walk pipeline write to them.
+ *
+ * Pure SQL-contract assertions against a fake QueryRunner. No Postgres.
+ *
+ * This file also carries the ORDERING guard, handed on from
+ * DeviceRoleAndDeclaredLinkParentMigration.test.ts: this is the newest
+ * registered migration, so its timestamp must sort above every other one.
+ * `generate-postgres-migration` stamps a WALL-CLOCK timestamp, while the
+ * recent migrations here use hand-picked round numbers that already run
+ * ahead of it — so a generated file lands BELOW several registered
+ * migrations unless somebody renumbers it, and runs out of order without
+ * anything saying so. Whoever adds the next migration should move this
+ * block to theirs.
+ */
+
+const MIGRATION_DIRECTORY: string = path.join(
+  __dirname,
+  "../../../Server/Infrastructure/Postgres/SchemaMigrations",
+);
+
+const MIGRATION_TIMESTAMP: string = "1787600000000";
+
+interface MigrationClass {
+  name: string;
+}
+
+function timestampOf(migrationClass: MigrationClass): number | null {
+  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
+  return match ? Number(match[1]) : null;
+}
+
+type MakeQueryRunnerResult = {
+  runner: QueryRunner;
+  statements: Array<string>;
+};
+
+type MakeQueryRunnerFunction = () => MakeQueryRunnerResult;
+
+const makeQueryRunner: MakeQueryRunnerFunction = (): MakeQueryRunnerResult => {
+  const statements: Array<string> = [];
+
+  const query: (...args: Array<unknown>) => Promise<undefined> = (
+    ...args: Array<unknown>
+  ): Promise<undefined> => {
+    statements.push(String(args[0]));
+    return Promise.resolve(undefined);
+  };
+
+  return {
+    runner: { query } as unknown as QueryRunner,
+    statements,
+  };
+};
+
+describe("AddNetworkDeviceReachabilityColumns1787600000000 — SQL contract", () => {
+  test("up() adds the two columns and backfills, in that order", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddNetworkDeviceReachabilityColumns1787600000000().up(runner);
+
+    expect(statements).toEqual([
+      `ALTER TABLE "NetworkDevice" ADD "lastPolledAt" TIMESTAMP WITH TIME ZONE`,
+      `ALTER TABLE "NetworkDevice" ADD "isReachable" boolean`,
+      `UPDATE "NetworkDevice" SET "lastPolledAt" = "lastSeenAt", "isReachable" = true WHERE "lastSeenAt" IS NOT NULL`,
+    ]);
+  });
+
+  /*
+   * NULL is a meaning here, not an absence: it is what the reachability rule
+   * reads as "never polled" and the UI renders as a gray Pending pill. A
+   * DEFAULT would give every pre-existing device a verdict on the strength
+   * of nothing.
+   */
+  test("both columns are nullable with no default", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddNetworkDeviceReachabilityColumns1787600000000().up(runner);
+
+    for (const statement of statements.filter((sql: string) => {
+      return sql.includes("ALTER TABLE");
+    })) {
+      expect(statement).not.toContain("NOT NULL");
+      expect(statement).not.toContain("DEFAULT");
+    }
+  });
+
+  /*
+   * A device with a lastSeenAt answered the last walk we have any record of
+   * — there is no record of a failure — so it is seeded reachable with that
+   * timestamp as its last attempt. Anything older than the staleness window
+   * still reads Down through the ordinary rule, so this is not a
+   * whitewash: it just declines to invent a failure that never happened.
+   */
+  test("the backfill only touches rows that have actually been seen", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddNetworkDeviceReachabilityColumns1787600000000().up(runner);
+
+    const backfill: string = statements[2]!;
+
+    expect(backfill).toContain(`WHERE "lastSeenAt" IS NOT NULL`);
+    expect(backfill).toContain(`"lastPolledAt" = "lastSeenAt"`);
+    expect(backfill).toContain(`"isReachable" = true`);
+  });
+
+  test("the backfill runs after the columns exist", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddNetworkDeviceReachabilityColumns1787600000000().up(runner);
+
+    const lastAddIndex: number = Math.max(
+      statements.findIndex((sql: string) => {
+        return sql.includes(`ADD "lastPolledAt"`);
+      }),
+      statements.findIndex((sql: string) => {
+        return sql.includes(`ADD "isReachable"`);
+      }),
+    );
+    const backfillIndex: number = statements.findIndex((sql: string) => {
+      return sql.startsWith("UPDATE");
+    });
+
+    expect(backfillIndex).toBeGreaterThan(lastAddIndex);
+  });
+
+  test("down() drops exactly what up() added, and nothing else", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddNetworkDeviceReachabilityColumns1787600000000().down(runner);
+
+    expect(statements).toEqual([
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "isReachable"`,
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "lastPolledAt"`,
+    ]);
+  });
+
+  /*
+   * Not just "same count": the exact column names, derived from the two
+   * statement sets rather than restated, so adding a column to up() without
+   * adding it to down() fails here.
+   */
+  test("up() and down() name the same columns", async () => {
+    const { runner: upRunner, statements: upStatements } = makeQueryRunner();
+    const { runner: downRunner, statements: downStatements } =
+      makeQueryRunner();
+
+    await new AddNetworkDeviceReachabilityColumns1787600000000().up(upRunner);
+    await new AddNetworkDeviceReachabilityColumns1787600000000().down(
+      downRunner,
+    );
+
+    const columnsIn: (
+      statements: Array<string>,
+      keyword: string,
+    ) => Array<string> = (
+      statements: Array<string>,
+      keyword: string,
+    ): Array<string> => {
+      return statements
+        .filter((sql: string) => {
+          return sql.includes(keyword);
+        })
+        .map((sql: string) => {
+          return sql.split(`${keyword} "`)[1]!.split('"')[0]!;
+        })
+        .sort();
+    };
+
+    expect(columnsIn(downStatements, "DROP COLUMN")).toEqual(
+      columnsIn(upStatements, "ADD"),
+    );
+  });
+});
+
+describe("registration", () => {
+  /*
+   * The step AGENTS.md calls out and the one that fails silently: a
+   * migration that is not in this array never runs, so the columns are
+   * missing in a real deployment while every read path and the walk
+   * pipeline reference them.
+   */
+  test("the migration is registered so it runs on boot", () => {
+    const names: Array<string> = SchemaMigrations.map(
+      (migration: new () => MigrationInterface): string => {
+        return migration.name;
+      },
+    );
+
+    expect(names).toContain("AddNetworkDeviceReachabilityColumns1787600000000");
+  });
+
+  test("it is registered exactly once", () => {
+    const occurrences: number = SchemaMigrations.filter(
+      (migration: new () => MigrationInterface): boolean => {
+        return (
+          migration.name === "AddNetworkDeviceReachabilityColumns1787600000000"
+        );
+      },
+    ).length;
+
+    expect(occurrences).toBe(1);
+  });
+
+  /*
+   * TypeORM records applied migrations by the `name` property, not the file
+   * name. A mismatch re-runs the migration on every boot.
+   */
+  test("its declared name matches its class name", () => {
+    expect(new AddNetworkDeviceReachabilityColumns1787600000000().name).toBe(
+      "AddNetworkDeviceReachabilityColumns1787600000000",
+    );
+  });
+});
+
+// The guard described in the header. Hand it to the next migration.
+describe("ordering", () => {
+  test("its timestamp sorts after every other registered migration", () => {
+    const ourTimestamp: number | null = timestampOf(
+      AddNetworkDeviceReachabilityColumns1787600000000,
+    );
+
+    expect(ourTimestamp).not.toBeNull();
+
+    const otherTimestamps: Array<number> = [];
+
+    for (const migrationClass of SchemaMigrations) {
+      if (migrationClass === AddNetworkDeviceReachabilityColumns1787600000000) {
+        continue;
+      }
+
+      const timestamp: number | null = timestampOf(
+        migrationClass as MigrationClass,
+      );
+
+      if (timestamp !== null) {
+        otherTimestamps.push(timestamp);
+      }
+    }
+
+    /*
+     * Math.max() of an empty list is -Infinity, which every timestamp beats.
+     * Prove the list was actually enumerated before leaning on the maximum.
+     */
+    expect(otherTimestamps.length).toBeGreaterThan(100);
+
+    expect(ourTimestamp).toBeGreaterThan(Math.max(...otherTimestamps));
+  });
+
+  test("it is registered last, matching that timestamp", () => {
+    expect(SchemaMigrations[SchemaMigrations.length - 1]).toBe(
+      AddNetworkDeviceReachabilityColumns1787600000000,
+    );
+  });
+
+  /*
+   * ...and the timestamp in the class name is the one on disk. A class
+   * renamed without renaming its file (or two migrations landing on the
+   * same timestamp) leaves the ordering above asserting something that is
+   * not what actually runs.
+   */
+  test("exactly one file on disk carries its timestamp, and it is this one", () => {
+    const matching: Array<string> = fs
+      .readdirSync(MIGRATION_DIRECTORY)
+      .filter((file: string): boolean => {
+        return file.startsWith(`${MIGRATION_TIMESTAMP}-`);
+      });
+
+    expect(matching).toEqual([
+      `${MIGRATION_TIMESTAMP}-AddNetworkDeviceReachabilityColumns.ts`,
+    ]);
+  });
+});
+
+/*
+ * The model side of the same contract. TypeORM generates the schema from
+ * these decorators, so a column that exists in the migration but not on the
+ * model (or vice versa) is exactly the drift the Postgres Schema Drift
+ * workflow fails on.
+ */
+describe("the NetworkDevice model carries the columns the migration adds", () => {
+  test("lastPolledAt and isReachable are declared on the model", () => {
+    const device: NetworkDevice = new NetworkDevice();
+
+    expect("lastPolledAt" in device).toBe(true);
+    expect("isReachable" in device).toBe(true);
+  });
+
+  test("they default to undefined, not to a fabricated verdict", () => {
+    const device: NetworkDevice = new NetworkDevice();
+
+    expect(device.lastPolledAt).toBeUndefined();
+    expect(device.isReachable).toBeUndefined();
+  });
+
+  test("a walk can set them independently of lastSeenAt", () => {
+    const device: NetworkDevice = new NetworkDevice();
+    const now: Date = new Date("2026-08-18T12:00:00.000Z");
+
+    device.lastPolledAt = now;
+    device.isReachable = false;
+
+    expect(device.lastPolledAt).toEqual(now);
+    expect(device.isReachable).toBe(false);
+    // A failed poll never moves the last successful contact.
+    expect(device.lastSeenAt).toBeUndefined();
+  });
+});

package/Tests/Server/Services/ApiKeyPermissionService.test.ts

@@ -0,0 +1,347 @@
+/**
+ * ApiKeyPermissionService.findPermissionsByApiKeyId cache tests.
+ *
+ * Every API-key-authenticated request builds its tenant permissions from this
+ * lookup, so it now consults a per-process 60s TTL cache before running the
+ * findBy (with its labels join). The contract pinned here is load-bearing in
+ * three ways:
+ * - the underlying query is unchanged: keyed by exactly the given apiKeyId,
+ *   as root, selecting permission / labels._id / isBlockPermission — and the
+ *   row -> DTO mapping preserves the old edge cases (undefined labels -> [],
+ *   isBlockPermission passed through unchanged, never defaulted)
+ * - hits and misses both return freshly built objects, so a caller mutating
+ *   its result cannot poison the permissions of every later request
+ * - the service's own lifecycle hooks (create/update/delete) clear the cache,
+ *   so a permission edit takes effect immediately in the process that made it;
+ *   the TTL only bounds staleness for OTHER processes.
+ *
+ * ApiKeyPermissionService.findBy is spied on, so no database is touched.
+ */
+
+import ApiKeyPermissionService, {
+  ApiKeyPermissionRow,
+} from "../../../Server/Services/ApiKeyPermissionService";
+import ApiKeyPermission from "../../../Models/DatabaseModels/ApiKeyPermission";
+import Label from "../../../Models/DatabaseModels/Label";
+import ObjectID from "../../../Types/ObjectID";
+import Permission from "../../../Types/Permission";
+import { getJestSpyOn } from "../../Spy";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * PasswordHash has a known, pre-existing TS5.9 compile failure under ts-jest
+ * (Buffer vs BinaryLike) that breaks every suite whose import graph reaches
+ * it. Nothing here touches password hashing; stub the module before the
+ * service import graph drags it into compilation.
+ */
+jest.mock("../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: class PasswordHashStub {},
+  };
+});
+
+const TTL_MS: number = 60 * 1000;
+
+/*
+ * The hooks are protected on purpose — DatabaseService calls them, feature
+ * code does not. Reaching them through a cast is how their cache-clearing
+ * behaviour can be pinned without standing up Postgres.
+ */
+type HookCallable = {
+  onBeforeCreate: (createBy: unknown) => Promise<unknown>;
+  onBeforeUpdate: (updateBy: unknown) => Promise<unknown>;
+  onBeforeDelete: (deleteBy: unknown) => Promise<unknown>;
+};
+
+function asHooks(service: unknown): HookCallable {
+  return service as unknown as HookCallable;
+}
+
+function makeModelRow(data: {
+  permission: Permission;
+  labelIds?: Array<ObjectID>;
+  isBlockPermission?: boolean;
+}): ApiKeyPermission {
+  const row: ApiKeyPermission = new ApiKeyPermission();
+  row.permission = data.permission;
+  if (data.labelIds) {
+    row.labels = data.labelIds.map((id: ObjectID) => {
+      const label: Label = new Label();
+      label.id = id;
+      return label;
+    });
+  }
+  if (data.isBlockPermission !== undefined) {
+    row.isBlockPermission = data.isBlockPermission;
+  }
+  return row;
+}
+
+function spyOnFindBy(): jest.SpyInstance {
+  return getJestSpyOn(ApiKeyPermissionService, "findBy");
+}
+
+describe("ApiKeyPermissionService.findPermissionsByApiKeyId", () => {
+  const apiKeyId: ObjectID = ObjectID.generate();
+
+  beforeEach(() => {
+    /*
+     * The cache lives on the singleton service, so entries written by one
+     * test would leak into the next without an explicit clear.
+     */
+    ApiKeyPermissionService.clearCache();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("runs the exact legacy query and maps rows onto DTOs", async () => {
+    const labelId: ObjectID = ObjectID.generate();
+    const findBy: jest.SpyInstance = spyOnFindBy().mockResolvedValue([
+      makeModelRow({
+        permission: Permission.CreateProjectIncident,
+        labelIds: [labelId],
+        isBlockPermission: true,
+      }),
+      makeModelRow({
+        // labels intentionally left undefined; isBlockPermission too.
+        permission: Permission.ReadProjectMonitor,
+      }),
+    ] as never);
+
+    const rows: Array<ApiKeyPermissionRow> =
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+
+    expect(findBy).toHaveBeenCalledTimes(1);
+    const arg: Record<string, any> = findBy.mock.calls[0]![0] as Record<
+      string,
+      any
+    >;
+    expect(arg["query"]["apiKeyId"].toString()).toBe(apiKeyId.toString());
+    expect(arg["props"]["isRoot"]).toBe(true);
+    expect(arg["select"]).toEqual({
+      permission: true,
+      labels: {
+        _id: true,
+      },
+      isBlockPermission: true,
+    });
+
+    expect(rows).toHaveLength(2);
+    // Label scope survives the string round-trip through the cache.
+    expect(rows[0]!.permission).toBe(Permission.CreateProjectIncident);
+    expect(
+      rows[0]!.labelIds.map((id: ObjectID) => {
+        return id.toString();
+      }),
+    ).toEqual([labelId.toString()]);
+    // A block row stays a block row.
+    expect(rows[0]!.isBlockPermission).toBe(true);
+    // Undefined labels become [] rather than crashing or staying undefined.
+    expect(rows[1]!.labelIds).toEqual([]);
+    // isBlockPermission is passed through unchanged, never defaulted.
+    expect(rows[1]!.isBlockPermission).toBeUndefined();
+  });
+
+  test("serves the second call for the same key from cache", async () => {
+    const findBy: jest.SpyInstance = spyOnFindBy().mockResolvedValue([
+      makeModelRow({
+        permission: Permission.ProjectMember,
+        isBlockPermission: false,
+      }),
+    ] as never);
+
+    const first: Array<ApiKeyPermissionRow> =
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+    const second: Array<ApiKeyPermissionRow> =
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+
+    expect(findBy).toHaveBeenCalledTimes(1);
+    expect(second).toHaveLength(1);
+    expect(second[0]!.permission).toBe(Permission.ProjectMember);
+    expect(second[0]!.isBlockPermission).toBe(false);
+    expect(first).toEqual(second);
+  });
+
+  test("hits return fresh objects, so mutation cannot poison the cache", async () => {
+    const labelId: ObjectID = ObjectID.generate();
+    spyOnFindBy().mockResolvedValue([
+      makeModelRow({
+        permission: Permission.CreateProjectIncident,
+        labelIds: [labelId],
+        isBlockPermission: false,
+      }),
+    ] as never);
+
+    const first: Array<ApiKeyPermissionRow> =
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+
+    // Mutate everything a caller could reach on the first result.
+    first[0]!.labelIds.pop();
+    first.pop();
+
+    const second: Array<ApiKeyPermissionRow> =
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+
+    expect(second).toHaveLength(1);
+    expect(
+      second[0]!.labelIds.map((id: ObjectID) => {
+        return id.toString();
+      }),
+    ).toEqual([labelId.toString()]);
+    // Distinct object graphs on every call, hit or miss.
+    expect(second).not.toBe(first);
+    expect(second[0]).not.toBe(first[0]);
+  });
+
+  test("caches distinct api keys independently", async () => {
+    const otherApiKeyId: ObjectID = ObjectID.generate();
+    const findBy: jest.SpyInstance = spyOnFindBy().mockImplementation(((
+      options: Record<string, any>,
+    ): Promise<Array<ApiKeyPermission>> => {
+      const queriedId: string = options["query"]["apiKeyId"].toString();
+      return Promise.resolve([
+        makeModelRow({
+          permission:
+            queriedId === apiKeyId.toString()
+              ? Permission.ProjectMember
+              : Permission.ReadProjectMonitor,
+          isBlockPermission: false,
+        }),
+      ]);
+    }) as never);
+
+    const first: Array<ApiKeyPermissionRow> =
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+    const other: Array<ApiKeyPermissionRow> =
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(otherApiKeyId);
+
+    expect(findBy).toHaveBeenCalledTimes(2);
+    expect(first[0]!.permission).toBe(Permission.ProjectMember);
+    expect(other[0]!.permission).toBe(Permission.ReadProjectMonitor);
+
+    // Both keys are now cached: repeat calls issue no further queries.
+    await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+    await ApiKeyPermissionService.findPermissionsByApiKeyId(otherApiKeyId);
+    expect(findBy).toHaveBeenCalledTimes(2);
+  });
+
+  test("a key with zero permission rows still short-circuits the second call", async () => {
+    const findBy: jest.SpyInstance = spyOnFindBy().mockResolvedValue(
+      [] as never,
+    );
+
+    await expect(
+      ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId),
+    ).resolves.toEqual([]);
+    await expect(
+      ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId),
+    ).resolves.toEqual([]);
+
+    expect(findBy).toHaveBeenCalledTimes(1);
+  });
+
+  test("expires after the 60s TTL and re-queries", async () => {
+    const base: number = Date.now();
+    let nowMs: number = base;
+    jest.spyOn(Date, "now").mockImplementation((): number => {
+      return nowMs;
+    });
+
+    const findBy: jest.SpyInstance = spyOnFindBy().mockResolvedValue(
+      [] as never,
+    );
+
+    await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+    expect(findBy).toHaveBeenCalledTimes(1);
+
+    // Just inside the TTL: still served from cache.
+    nowMs = base + TTL_MS - 1;
+    await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+    expect(findBy).toHaveBeenCalledTimes(1);
+
+    // Past the TTL: the entry has expired and the key is re-queried.
+    nowMs = base + TTL_MS + 1;
+    await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+    expect(findBy).toHaveBeenCalledTimes(2);
+  });
+
+  describe("invalidation", () => {
+    type PrimeCacheFunction = () => Promise<jest.SpyInstance>;
+
+    const primeCache: PrimeCacheFunction =
+      async (): Promise<jest.SpyInstance> => {
+        const findBy: jest.SpyInstance = spyOnFindBy().mockResolvedValue(
+          [] as never,
+        );
+        await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+        expect(findBy).toHaveBeenCalledTimes(1);
+        return findBy;
+      };
+
+    test("clearCache() drops every cached entry", async () => {
+      const findBy: jest.SpyInstance = await primeCache();
+
+      ApiKeyPermissionService.clearCache();
+
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+      expect(findBy).toHaveBeenCalledTimes(2);
+    });
+
+    test("creating a permission clears the cache", async () => {
+      const findBy: jest.SpyInstance = await primeCache();
+
+      // The duplicate-permission check inside the hook must find nothing.
+      getJestSpyOn(ApiKeyPermissionService, "findOneBy").mockResolvedValue(
+        null,
+      );
+
+      const data: ApiKeyPermission = new ApiKeyPermission();
+      data.apiKeyId = apiKeyId;
+      data.projectId = ObjectID.generate();
+      data.permission = Permission.ProjectMember;
+
+      await asHooks(ApiKeyPermissionService).onBeforeCreate({
+        data: data,
+        props: { isRoot: true },
+      });
+
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+      expect(findBy).toHaveBeenCalledTimes(2);
+    });
+
+    test("updating a permission clears the cache", async () => {
+      const findBy: jest.SpyInstance = await primeCache();
+
+      await asHooks(ApiKeyPermissionService).onBeforeUpdate({
+        query: {},
+        data: {},
+        props: { isRoot: true },
+      });
+
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+      expect(findBy).toHaveBeenCalledTimes(2);
+    });
+
+    test("deleting a permission clears the cache", async () => {
+      const findBy: jest.SpyInstance = await primeCache();
+
+      await asHooks(ApiKeyPermissionService).onBeforeDelete({
+        query: {},
+        props: { isRoot: true },
+      });
+
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+      expect(findBy).toHaveBeenCalledTimes(2);
+    });
+  });
+});