@oneuptime/common 12.0.12 → 12.0.13

package/Tests/Server/Types/Database/Permissions/AccessControlPermission.test.ts

@@ -3,6 +3,9 @@ import AccessControlPermission from "../../../../../Server/Types/Database/Permis
 import QueryUtil from "../../../../../Server/Types/Database/QueryUtil";
 import Monitor from "../../../../../Models/DatabaseModels/Monitor";
 import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../../../../Types/ObjectID";
 import Permission, {
   UserTenantAccessPermission,
@@ -187,3 +190,165 @@ describe("AccessControlPermission.addAccessControlIdsToQuery", () => {
     expect(result._id).toBeUndefined();
   });
 });
+
+describe("AccessControlPermission.getAccessControlIdsForQuery", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const permittedLabelA: ObjectID = ObjectID.generate();
+  const permittedLabelB: ObjectID = ObjectID.generate();
+
+  function makeLabelRestrictedProps(): DatabaseCommonInteractionProps {
+    // A user whose ONLY read grant on Monitor is label-restricted.
+    const tenantPermission: UserTenantAccessPermission = {
+      projectId,
+      _type: "UserTenantAccessPermission",
+      permissions: [
+        {
+          _type: "UserPermission",
+          permission: Permission.ReadProjectMonitor,
+          labelIds: [permittedLabelA, permittedLabelB],
+          isBlockPermission: false,
+        },
+      ],
+    };
+
+    return {
+      userId,
+      tenantId: projectId,
+      userTenantAccessPermission: {
+        [projectId.toString()]: tenantPermission,
+      },
+    };
+  }
+
+  function toStrings(ids: Array<ObjectID>): Array<string> {
+    return ids.map((id: ObjectID) => {
+      return id.toString();
+    });
+  }
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("returns the permitted label ids deduped for a multi-column select, same as a query-only call", () => {
+    const withSelect: Array<ObjectID> =
+      AccessControlPermission.getAccessControlIdsForQuery(
+        Monitor,
+        { projectId } as any,
+        { _id: true, createdAt: true, name: true } as any,
+        makeLabelRestrictedProps(),
+        DatabaseRequestType.Read,
+      );
+
+    const queryOnly: Array<ObjectID> =
+      AccessControlPermission.getAccessControlIdsForQuery(
+        Monitor,
+        { projectId } as any,
+        null,
+        makeLabelRestrictedProps(),
+        DatabaseRequestType.Read,
+      );
+
+    expect(toStrings(withSelect)).toEqual([
+      permittedLabelA.toString(),
+      permittedLabelB.toString(),
+    ]);
+    expect(toStrings(withSelect)).toEqual(toStrings(queryOnly));
+  });
+
+  it("returns an empty array for users with an unrestricted grant regardless of column count", () => {
+    const tenantPermission: UserTenantAccessPermission = {
+      projectId,
+      _type: "UserTenantAccessPermission",
+      permissions: [
+        {
+          _type: "UserPermission",
+          permission: Permission.ProjectMember,
+          labelIds: [],
+          isBlockPermission: false,
+        },
+      ],
+    };
+
+    const result: Array<ObjectID> =
+      AccessControlPermission.getAccessControlIdsForQuery(
+        Monitor,
+        { projectId } as any,
+        { _id: true, createdAt: true, updatedAt: true, name: true } as any,
+        {
+          userId,
+          tenantId: projectId,
+          userTenantAccessPermission: {
+            [projectId.toString()]: tenantPermission,
+          },
+        },
+        DatabaseRequestType.Read,
+      );
+
+    expect(result).toEqual([]);
+  });
+
+  it("computes user permissions exactly once regardless of column count", () => {
+    const getUserPermissionsSpy: jest.SpyInstance = jest.spyOn(
+      DatabaseCommonInteractionPropsUtil,
+      "getUserPermissions",
+    );
+
+    const props: DatabaseCommonInteractionProps = makeLabelRestrictedProps();
+
+    AccessControlPermission.getAccessControlIdsForQuery(
+      Monitor,
+      { projectId } as any,
+      { _id: true, createdAt: true, updatedAt: true, name: true } as any,
+      props,
+      DatabaseRequestType.Read,
+    );
+
+    /*
+     * Perf regression guard: the old code rebuilt the full user-permission
+     * set once per access-controlled column plus once for the model-level
+     * check. The context must be built exactly once per query.
+     */
+    expect(getUserPermissionsSpy).toHaveBeenCalledTimes(1);
+    expect(getUserPermissionsSpy).toHaveBeenCalledWith(
+      props,
+      PermissionType.Allow,
+    );
+  });
+
+  it("still applies the idempotent Public push to props exactly once", () => {
+    const props: DatabaseCommonInteractionProps = makeLabelRestrictedProps();
+
+    AccessControlPermission.getAccessControlIdsForQuery(
+      Monitor,
+      { projectId } as any,
+      { _id: true, createdAt: true, name: true } as any,
+      props,
+      DatabaseRequestType.Read,
+    );
+
+    const globalPermissions: Array<Permission> =
+      props.userGlobalAccessPermission?.globalPermissions || [];
+
+    expect(
+      globalPermissions.filter((permission: Permission) => {
+        return permission === Permission.Public;
+      }),
+    ).toHaveLength(1);
+  });
+
+  it("getAccessControlIdsForModel with three args still returns the model-level permitted ids", () => {
+    const result: Array<ObjectID> =
+      AccessControlPermission.getAccessControlIdsForModel(
+        Monitor,
+        makeLabelRestrictedProps(),
+        DatabaseRequestType.Read,
+      );
+
+    expect(toStrings(result)).toEqual([
+      permittedLabelA.toString(),
+      permittedLabelB.toString(),
+    ]);
+  });
+});

package/Tests/Server/Utils/APIKey/AccessPermission.test.ts

@@ -6,10 +6,24 @@ import {
   it,
   jest,
 } from "@jest/globals";
+
+/*
+ * PasswordHash has a known, pre-existing TS5.9 compile failure under ts-jest
+ * (Buffer vs BinaryLike) that breaks every suite whose import graph reaches
+ * it. Nothing here touches password hashing; stub the module before the
+ * service import graph drags it into compilation.
+ */
+jest.mock("../../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: class PasswordHashStub {},
+  };
+});
+
 import APIKeyAccessPermission from "../../../../Server/Utils/APIKey/AccessPermission";
-import ApiKeyPermissionService from "../../../../Server/Services/ApiKeyPermissionService";
-import APIKeyPermission from "../../../../Models/DatabaseModels/ApiKeyPermission";
-import Label from "../../../../Models/DatabaseModels/Label";
+import ApiKeyPermissionService, {
+  ApiKeyPermissionRow,
+} from "../../../../Server/Services/ApiKeyPermissionService";
 import ObjectID from "../../../../Types/ObjectID";
 import Permission, {
   UserGlobalAccessPermission,
@@ -27,10 +41,11 @@ import { getJestSpyOn } from "../../../Spy";
  * key full control of the project; one that dropped it from the master path
  * would break trusted internal automation. Both directions are pinned below.
  *
- * getApiTenantAccessPermission also reshapes stored permission rows into the
- * runtime UserPermission shape (labels -> labelIds, block flag preserved). That
- * mapping is where a dropped label would quietly widen a scoped permission, so
- * it is tested against a spied service rather than a live database.
+ * getApiTenantAccessPermission also reshapes the (cached) permission rows into
+ * the runtime UserPermission shape (labelIds carried over, block flag
+ * preserved). That mapping is where a dropped label would quietly widen a
+ * scoped permission, so it is tested against a spied service rather than a
+ * live database.
  */
 
 const projectId: ObjectID = ObjectID.generate();
@@ -118,9 +133,9 @@ describe("APIKeyAccessPermission.getMasterApiTenantAccessPermission", () => {
 });
 
 describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
-  const spyFindBy: jest.SpyInstance = getJestSpyOn(
+  const spyFindPermissions: jest.SpyInstance = getJestSpyOn(
     ApiKeyPermissionService,
-    "findBy",
+    "findPermissionsByApiKeyId",
   );
 
   beforeEach(() => {
@@ -135,40 +150,33 @@ describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
     permission: Permission;
     labelIds?: Array<ObjectID>;
     isBlockPermission?: boolean;
-  }) => APIKeyPermission = (data: {
+  }) => ApiKeyPermissionRow = (data: {
     permission: Permission;
     labelIds?: Array<ObjectID>;
     isBlockPermission?: boolean;
-  }): APIKeyPermission => {
-    const row: APIKeyPermission = new APIKeyPermission();
-    row.permission = data.permission;
-    if (data.labelIds) {
-      row.labels = data.labelIds.map((id: ObjectID) => {
-        const label: Label = new Label();
-        label.id = id;
-        return label;
-      });
-    }
-    row.isBlockPermission = data.isBlockPermission ?? false;
-    return row;
+  }): ApiKeyPermissionRow => {
+    return {
+      permission: data.permission,
+      labelIds: data.labelIds ?? [],
+      isBlockPermission: data.isBlockPermission ?? false,
+    };
   };
 
   it("queries the permissions for exactly this api key", async () => {
-    spyFindBy.mockResolvedValue([] as never);
+    spyFindPermissions.mockResolvedValue([] as never);
 
     await APIKeyAccessPermission.getApiTenantAccessPermission(
       projectId,
       apiKeyId,
     );
 
-    expect(spyFindBy).toHaveBeenCalledTimes(1);
-    const arg: { query: { apiKeyId: ObjectID } } = spyFindBy.mock
-      .calls[0]![0] as { query: { apiKeyId: ObjectID } };
-    expect(arg.query.apiKeyId.toString()).toBe(apiKeyId.toString());
+    expect(spyFindPermissions).toHaveBeenCalledTimes(1);
+    const arg: ObjectID = spyFindPermissions.mock.calls[0]![0] as ObjectID;
+    expect(arg.toString()).toBe(apiKeyId.toString());
   });
 
   it("returns just the default baseline when the key has no permissions", async () => {
-    spyFindBy.mockResolvedValue([] as never);
+    spyFindPermissions.mockResolvedValue([] as never);
 
     const perm: UserTenantAccessPermission =
       await APIKeyAccessPermission.getApiTenantAccessPermission(
@@ -187,7 +195,7 @@ describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
 
   it("maps each stored permission row onto the tenant permission", async () => {
     const labelId: ObjectID = ObjectID.generate();
-    spyFindBy.mockResolvedValue([
+    spyFindPermissions.mockResolvedValue([
       makeRow({
         permission: Permission.CreateProjectIncident,
         labelIds: [labelId],
@@ -219,7 +227,7 @@ describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
   });
 
   it("preserves the block flag so a deny row stays a deny row", async () => {
-    spyFindBy.mockResolvedValue([
+    spyFindPermissions.mockResolvedValue([
       makeRow({
         permission: Permission.CreateProjectIncident,
         labelIds: [],
@@ -243,11 +251,16 @@ describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
   });
 
   it("treats a row with no labels as an empty (unscoped) label set", async () => {
-    const row: APIKeyPermission = new APIKeyPermission();
-    row.permission = Permission.CreateProjectIncident;
-    // labels intentionally left undefined.
-    row.isBlockPermission = false;
-    spyFindBy.mockResolvedValue([row] as never);
+    /*
+     * The service DTO normalizes a stored row's undefined labels to [] (pinned
+     * in ApiKeyPermissionService.test.ts); here the mapping must keep that
+     * empty set an array rather than dropping it to undefined.
+     */
+    spyFindPermissions.mockResolvedValue([
+      makeRow({
+        permission: Permission.CreateProjectIncident,
+      }),
+    ] as never);
 
     const perm: UserTenantAccessPermission =
       await APIKeyAccessPermission.getApiTenantAccessPermission(
@@ -261,7 +274,6 @@ describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
       },
     );
     expect(mapped).toBeDefined();
-    // No crash on undefined labels, and it becomes [] rather than undefined.
     expect(mapped!.labelIds).toEqual([]);
   });
 });

package/Tests/Server/Utils/AnalyticsDatabase/StatementGenerator.test.ts

@@ -956,6 +956,219 @@ describe("StatementGenerator", () => {
       });
     });
 
+    /*
+     * resourceEntityScopes: the compiled form of a resource-facet selection
+     * (a Kubernetes cluster, a host, ...). Unlike entityScope it carries an
+     * `entityIds` branch, because the same resource can be a row's PRIMARY
+     * entity (agent-ingested telemetry) or merely one of its memberships
+     * (OTLP telemetry primary-keyed on its Service). Matching only
+     * primaryEntityId is what made a cluster filter return zero rows for
+     * collector-ingested logs.
+     */
+    describe("resourceEntityScopes synthetic key", () => {
+      class ResourceScopeModel extends AnalyticsBaseModel {
+        public constructor() {
+          super({
+            tableName: "<resource-scope-table>",
+            singularName: "<singular>",
+            pluralName: "<plural>",
+            tableColumns: [
+              new AnalyticsTableColumn({
+                key: "_id",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                type: TableColumnType.ObjectID,
+              }),
+              new AnalyticsTableColumn({
+                key: "primaryEntityId",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                type: TableColumnType.ObjectID,
+              }),
+              new AnalyticsTableColumn({
+                key: "entityKeys",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                defaultValue: [],
+                type: TableColumnType.ArrayText,
+              }),
+              new AnalyticsTableColumn({
+                key: "attributes",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                defaultValue: {},
+                type: TableColumnType.MapStringString,
+              }),
+            ],
+            crudApiPath: new Route("route"),
+            primaryKeys: ["_id"],
+            sortKeys: ["_id"],
+            partitionKey: "_id",
+            tableEngine: AnalyticsTableEngine.MergeTree,
+          });
+        }
+      }
+
+      const CLUSTER_ID: string = "8c0f2f1e-2e4f-4a8c-9a1a-2f5b6c7d8e9f";
+      const HOST_ID: string = "5f4e3d2c-1b0a-4998-8776-655443322110";
+
+      let resourceGenerator: StatementGenerator<ResourceScopeModel>;
+      beforeEach(() => {
+        resourceGenerator = new StatementGenerator<ResourceScopeModel>({
+          modelType: ResourceScopeModel,
+          database: ClickhouseAppInstance,
+        });
+      });
+
+      test("ORs the three membership branches inside one scope", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [
+            {
+              entityIds: [CLUSTER_ID],
+              entityKeys: ["210dac24142f1baa"],
+              attributeKey: "resource.k8s.cluster.name",
+              attributeValues: ["prod-eu"],
+            },
+          ],
+        } as any);
+
+        expect(statement.query).toBe(
+          "AND ({p0:Identifier} IN {p1:Array(String)} OR hasAny({p2:Identifier}, {p3:Array(String)}) OR {p4:Identifier}[{p5:String}] IN {p6:Array(String)})",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "primaryEntityId",
+          p1: [CLUSTER_ID],
+          p2: "entityKeys",
+          p3: ["210dac24142f1baa"],
+          p4: "attributes",
+          p5: "resource.k8s.cluster.name",
+          p6: ["prod-eu"],
+        });
+      });
+
+      test("ANDs separate scopes so two facets intersect", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [
+            { entityIds: [CLUSTER_ID], entityKeys: ["210dac24142f1baa"] },
+            { entityIds: [HOST_ID], entityKeys: ["9f8e7d6c5b4a3928"] },
+          ],
+        } as any);
+
+        expect(statement.query).toBe(
+          "AND ({p0:Identifier} IN {p1:Array(String)} OR hasAny({p2:Identifier}, {p3:Array(String)})) " +
+            "AND ({p4:Identifier} IN {p5:Array(String)} OR hasAny({p6:Identifier}, {p7:Array(String)}))",
+        );
+      });
+
+      test("composes with a Services predicate — cluster AND service", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          primaryEntityId: "<service-id>",
+          resourceEntityScopes: [
+            { entityIds: [CLUSTER_ID], entityKeys: ["210dac24142f1baa"] },
+          ],
+        } as any);
+
+        /*
+         * The regression the issue reports: these two used to be coalesced
+         * into ONE primaryEntityId IN (...) list, so adding a service made
+         * results reappear while silently dropping the cluster.
+         */
+        expect(statement.query).toBe(
+          "AND {p0:Identifier} = {p1:String} " +
+            "AND ({p2:Identifier} IN {p3:Array(String)} OR hasAny({p4:Identifier}, {p5:Array(String)}))",
+        );
+      });
+
+      test("a scope that resolved to ids only still narrows by primaryEntityId", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [{ entityIds: [CLUSTER_ID], entityKeys: [] }],
+        } as any);
+
+        expect(statement.query).toBe(
+          "AND ({p0:Identifier} IN {p1:Array(String)})",
+        );
+      });
+
+      test("an empty scope emits no predicate rather than an empty IN", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [{ entityIds: [], entityKeys: [] }],
+        } as any);
+
+        expect(statement.query).toBe("");
+        expect(statement.query_params).toStrictEqual({});
+      });
+
+      test("an empty scope does not break separators for later predicates", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [{ entityIds: [], entityKeys: [] }],
+          _id: "<value>",
+        } as any);
+
+        expect(statement.query).toBe("AND {p0:Identifier} = {p1:String}");
+      });
+
+      test("a non-array value carries no predicate", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: { entityIds: [CLUSTER_ID] },
+        } as any);
+
+        expect(statement.query).toBe("");
+      });
+
+      test("blank ids and keys are filtered out of their branches", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [
+            { entityIds: ["", CLUSTER_ID], entityKeys: [""] },
+          ],
+        } as any);
+
+        expect(statement.query).toBe(
+          "AND ({p0:Identifier} IN {p1:Array(String)})",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "primaryEntityId",
+          p1: [CLUSTER_ID],
+        });
+      });
+
+      test("drops the branches whose backing column the model lacks", () => {
+        // TestModel (outer generator) has neither primaryEntityId nor entityKeys.
+        const statement: Statement = generator.toWhereStatement({
+          resourceEntityScopes: [
+            { entityIds: [CLUSTER_ID], entityKeys: ["210dac24142f1baa"] },
+          ],
+        } as any);
+
+        expect(statement.query).toBe("");
+      });
+
+      test("qualifies every branch when a table alias is in play", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement(
+          {
+            resourceEntityScopes: [
+              {
+                entityIds: [CLUSTER_ID],
+                entityKeys: ["210dac24142f1baa"],
+                attributeKey: "resource.k8s.cluster.name",
+                attributeValues: ["prod-eu"],
+              },
+            ],
+          } as any,
+          { tableAlias: "t" },
+        );
+
+        expect(statement.query).toBe(
+          "AND ({p0_t:Identifier}.{p0_c:Identifier} IN {p1:Array(String)} OR " +
+            "hasAny({p2_t:Identifier}.{p2_c:Identifier}, {p3:Array(String)}) OR " +
+            "{p4_t:Identifier}.{p4_c:Identifier}[{p5:String}] IN {p6:Array(String)})",
+        );
+      });
+    });
+
     /*
      * Table qualification (tableAlias option). Aggregate statements
      * alias expressions to real column names (`sum(col) as col`, and