@oneuptime/common 12.0.12 → 12.0.13

package/Tests/Server/Utils/SessionReplay/SessionReplayGateCacheStore.test.ts

@@ -0,0 +1,207 @@
+import ObjectID from "../../../../Types/ObjectID";
+
+/*
+ * The policy cache is keyed by projectId plus a CLIENT-supplied appIdentifier,
+ * so anyone holding an ingestion key (which ships in public browser JS) can
+ * mint unlimited distinct keys. These tests pin that the store is bounded -
+ * the regression they guard is the unbounded module-level Map that grew until
+ * the ingest pod was OOM-killed - while preserving the store's contracts:
+ * negative (null-policy) caching, per-project prefix invalidation, and the
+ * kill marker that must always land even at capacity.
+ */
+
+jest.mock("../../../../Server/Infrastructure/Redis", () => {
+  return {
+    __esModule: true,
+    default: {
+      getClient: jest.fn().mockReturnValue(null),
+      isConnected: jest.fn().mockReturnValue(false),
+    },
+  };
+});
+
+jest.mock("../../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+    },
+  };
+});
+
+import SessionReplayGateCacheStore, {
+  MAX_KILL_KEY_CACHE_ENTRIES,
+  MAX_POLICY_CACHE_ENTRIES,
+  PolicyCacheEntry,
+} from "../../../../Server/Utils/SessionReplay/SessionReplayGateCacheStore";
+
+type TestPolicy = { name: string };
+
+function policyKey(prefix: string, index: number): string {
+  return `${prefix}:app-${index}`;
+}
+
+function fillPolicyCache(prefix: string, count: number): void {
+  for (let i: number = 0; i < count; i++) {
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>(
+      policyKey(prefix, i),
+      { name: `policy-${i}` },
+    );
+  }
+}
+
+describe("SessionReplayGateCacheStore bounded policy cache", (): void => {
+  beforeEach((): void => {
+    jest.clearAllMocks();
+    /* Module-level Maps persist across tests. */
+    SessionReplayGateCacheStore.clearCache();
+  });
+
+  it("evicts the oldest entry instead of growing past the cap under a unique-key flood", (): void => {
+    fillPolicyCache("proj", MAX_POLICY_CACHE_ENTRIES + 1);
+
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", 0),
+      ),
+    ).toBeUndefined();
+
+    const last: PolicyCacheEntry<TestPolicy> | undefined =
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", MAX_POLICY_CACHE_ENTRIES),
+      );
+    expect(last).toBeDefined();
+    expect(last?.policy).toEqual({
+      name: `policy-${MAX_POLICY_CACHE_ENTRIES}`,
+    });
+  }, 15000);
+
+  it("rewriting an existing key at capacity evicts nothing", (): void => {
+    fillPolicyCache("proj", MAX_POLICY_CACHE_ENTRIES);
+
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>(
+      policyKey("proj", 5),
+      { name: "rewritten" },
+    );
+
+    for (let i: number = 0; i < MAX_POLICY_CACHE_ENTRIES; i++) {
+      expect(
+        SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+          policyKey("proj", i),
+        ),
+      ).toBeDefined();
+    }
+
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", 5),
+      )?.policy,
+    ).toEqual({ name: "rewritten" });
+  }, 15000);
+
+  it("a rewrite refreshes recency, so the next eviction takes the stale key", (): void => {
+    fillPolicyCache("proj", MAX_POLICY_CACHE_ENTRIES);
+
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>(
+      policyKey("proj", 0),
+      { name: "refreshed" },
+    );
+
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>("proj:app-new", {
+      name: "new",
+    });
+
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", 1),
+      ),
+    ).toBeUndefined();
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", 0),
+      )?.policy,
+    ).toEqual({ name: "refreshed" });
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>("proj:app-new"),
+    ).toBeDefined();
+  }, 15000);
+
+  it("still caches null policies - the hot-path refusal must stay cached", (): void => {
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>(
+      "proj:app-none",
+      null,
+    );
+
+    const entry: PolicyCacheEntry<TestPolicy> | undefined =
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>("proj:app-none");
+
+    expect(entry).toBeDefined();
+    expect(entry?.policy).toBeNull();
+    expect(typeof entry?.loadedAt).toBe("number");
+  });
+
+  it("clearCache(projectId) deletes exactly that project's prefixed entries after evictions", (): void => {
+    const projectA: ObjectID = ObjectID.generate();
+    const projectB: ObjectID = ObjectID.generate();
+
+    fillPolicyCache(projectA.toString(), MAX_POLICY_CACHE_ENTRIES);
+    /* These writes evict projectA's oldest entries. */
+    fillPolicyCache(projectB.toString(), 5);
+
+    SessionReplayGateCacheStore.clearCache(projectA);
+
+    for (let i: number = 0; i < MAX_POLICY_CACHE_ENTRIES; i++) {
+      expect(
+        SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+          policyKey(projectA.toString(), i),
+        ),
+      ).toBeUndefined();
+    }
+
+    for (let i: number = 0; i < 5; i++) {
+      expect(
+        SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+          policyKey(projectB.toString(), i),
+        ),
+      ).toBeDefined();
+    }
+  }, 15000);
+});
+
+describe("SessionReplayGateCacheStore bounded kill-key cache", (): void => {
+  beforeEach((): void => {
+    jest.clearAllMocks();
+    SessionReplayGateCacheStore.clearCache();
+  });
+
+  it("the local kill marker always lands, even at capacity", async (): Promise<void> => {
+    /* Redis is absent, so the fail-open path caches isDisabled:false. */
+    for (let i: number = 0; i < MAX_KILL_KEY_CACHE_ENTRIES; i++) {
+      await SessionReplayGateCacheStore.isProjectKilled(ObjectID.generate());
+    }
+
+    const killedProject: ObjectID = ObjectID.generate();
+    await SessionReplayGateCacheStore.markProjectDisabled(killedProject);
+
+    expect(
+      await SessionReplayGateCacheStore.isProjectKilled(killedProject),
+    ).toBe(true);
+  }, 30000);
+
+  it("an evicted kill entry re-resolves through the normal path", async (): Promise<void> => {
+    const firstProject: ObjectID = ObjectID.generate();
+    await SessionReplayGateCacheStore.isProjectKilled(firstProject);
+
+    /* Push the first project's entry out of the bounded map. */
+    for (let i: number = 0; i < MAX_KILL_KEY_CACHE_ENTRIES; i++) {
+      await SessionReplayGateCacheStore.isProjectKilled(ObjectID.generate());
+    }
+
+    await expect(
+      SessionReplayGateCacheStore.isProjectKilled(firstProject),
+    ).resolves.toBe(false);
+  }, 30000);
+});

package/Tests/Server/Utils/StartServerBodyVerify.test.ts

@@ -0,0 +1,335 @@
+import {
+  jsonBodyParserOptions,
+  urlEncodedBodyParserOptions,
+} from "../../../Server/Utils/StartServer";
+import {
+  ExpressJson,
+  ExpressRequest,
+  ExpressResponse,
+  ExpressUrlEncoded,
+  OneUptimeRequest,
+  RequestHandler,
+} from "../../../Server/Utils/Express";
+import logger from "../../../Server/Utils/Logger";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { Readable } from "stream";
+import fs from "fs";
+import path from "path";
+
+/*
+ * The body-parser verify callbacks capture the raw request body for webhook
+ * signature verification (Slack, WhatsApp, GitHub, billing). Every consumer
+ * does a read-only string comparison against the captured value, so the
+ * urlencoded path must alias ONE decoded string to both rawBody and
+ * rawFormUrlEncodedBody instead of decoding the buffer twice, and neither
+ * path may embed the body (which carries signing material) in its debug
+ * message.
+ */
+
+type SpyLike = {
+  mock: { calls: Array<Array<unknown>> };
+  mockRestore: () => void;
+};
+
+type MockFn = ReturnType<typeof jest.fn>;
+
+const JSON_DEBUG_MESSAGE: string =
+  "Raw JSON Body for signature verification captured";
+const URL_ENCODED_DEBUG_MESSAGE: string =
+  "Raw Form Url Encoded Body for signature verification captured";
+
+let debugSpy: SpyLike;
+
+beforeEach(() => {
+  debugSpy = jest
+    .spyOn(logger, "debug")
+    .mockImplementation((): void => {}) as unknown as SpyLike;
+});
+
+afterEach(() => {
+  debugSpy.mockRestore();
+});
+
+type VerifyInvoker = (req: OneUptimeRequest, buf: Buffer) => void;
+
+const invokeUrlEncodedVerify: VerifyInvoker = (
+  req: OneUptimeRequest,
+  buf: Buffer,
+): void => {
+  urlEncodedBodyParserOptions.verify(
+    req as ExpressRequest,
+    {} as ExpressResponse,
+    buf,
+  );
+};
+
+const invokeJsonVerify: VerifyInvoker = (
+  req: OneUptimeRequest,
+  buf: Buffer,
+): void => {
+  jsonBodyParserOptions.verify(
+    req as ExpressRequest,
+    {} as ExpressResponse,
+    buf,
+  );
+};
+
+describe("urlencoded verify: single decode aliased to both fields", () => {
+  test("decodes the buffer exactly once", () => {
+    const toString: MockFn = jest.fn().mockReturnValue("a=1&b=2");
+    const req: OneUptimeRequest = {} as OneUptimeRequest;
+
+    invokeUrlEncodedVerify(req, { toString } as unknown as Buffer);
+
+    expect(toString).toHaveBeenCalledTimes(1);
+  });
+
+  test("both fields come from the SAME decode, not two independent copies", () => {
+    /*
+     * A buffer whose toString returns a different value on every call: with
+     * one decode both fields hold the first value; the old two-decode code
+     * would leave the second value on rawBody.
+     */
+    const toString: MockFn = jest
+      .fn()
+      .mockReturnValueOnce("first-decode")
+      .mockReturnValue("second-decode");
+    const req: OneUptimeRequest = {} as OneUptimeRequest;
+
+    invokeUrlEncodedVerify(req, { toString } as unknown as Buffer);
+
+    expect(req.rawFormUrlEncodedBody).toBe("first-decode");
+    expect(req.rawBody).toBe("first-decode");
+    expect(req.rawBody).toBe(req.rawFormUrlEncodedBody);
+  });
+
+  test("captures an ASCII body byte-identical to buf.toString()", () => {
+    const body: string = "a=1&b=2&msg=hello+world&sig=abc123";
+    const buf: Buffer = Buffer.from(body);
+    const req: OneUptimeRequest = {} as OneUptimeRequest;
+
+    invokeUrlEncodedVerify(req, buf);
+
+    expect(req.rawFormUrlEncodedBody).toBe(buf.toString());
+    expect(req.rawBody).toBe(buf.toString());
+    expect(req.rawBody).toBe(body);
+  });
+
+  test("captures a multi-byte UTF-8 body byte-identical to buf.toString()", () => {
+    const body: string = "name=Grüße&emoji=🚀🔥&city=東京&mixed=a™b";
+    const buf: Buffer = Buffer.from(body, "utf8");
+    const req: OneUptimeRequest = {} as OneUptimeRequest;
+
+    invokeUrlEncodedVerify(req, buf);
+
+    expect(req.rawFormUrlEncodedBody).toBe(buf.toString());
+    expect(req.rawBody).toBe(buf.toString());
+    expect(req.rawBody).toBe(body);
+  });
+});
+
+describe("urlencoded verify: debug log is constant and body-free", () => {
+  test("logs the constant message with request attributes, never the body", () => {
+    const secret: string = "SlackSigningSecretMarker123";
+    const req: OneUptimeRequest = {
+      requestId: "req-123",
+    } as OneUptimeRequest;
+
+    invokeUrlEncodedVerify(req, Buffer.from(`token=${secret}&user=alice`));
+
+    expect(debugSpy.mock.calls).toHaveLength(1);
+
+    const message: unknown = debugSpy.mock.calls[0]![0];
+    const attributes: unknown = debugSpy.mock.calls[0]![1];
+
+    expect(message).toBe(URL_ENCODED_DEBUG_MESSAGE);
+    expect(message as string).not.toContain(secret);
+    expect(message as string).not.toContain("alice");
+    expect(attributes).toEqual({ requestId: "req-123" });
+  });
+});
+
+describe("json verify: regression guard", () => {
+  test("sets rawBody to the exact body and leaves rawFormUrlEncodedBody unset", () => {
+    const body: string = '{"alert":"CPU high","city":"東京","emoji":"🚀"}';
+    const req: OneUptimeRequest = {} as OneUptimeRequest;
+
+    invokeJsonVerify(req, Buffer.from(body, "utf8"));
+
+    expect(req.rawBody).toBe(body);
+    expect(req.rawFormUrlEncodedBody).toBeUndefined();
+  });
+
+  test("decodes the buffer exactly once", () => {
+    const toString: MockFn = jest.fn().mockReturnValue("{}");
+    const req: OneUptimeRequest = {} as OneUptimeRequest;
+
+    invokeJsonVerify(req, { toString } as unknown as Buffer);
+
+    expect(toString).toHaveBeenCalledTimes(1);
+    expect(req.rawBody).toBe("{}");
+  });
+
+  test("logs the constant message with request attributes, never the body", () => {
+    const secret: string = "GitHubWebhookSecretMarker456";
+    const req: OneUptimeRequest = {
+      requestId: "req-456",
+    } as OneUptimeRequest;
+
+    invokeJsonVerify(req, Buffer.from(`{"secret":"${secret}"}`));
+
+    expect(debugSpy.mock.calls).toHaveLength(1);
+
+    const message: unknown = debugSpy.mock.calls[0]![0];
+    const attributes: unknown = debugSpy.mock.calls[0]![1];
+
+    expect(message).toBe(JSON_DEBUG_MESSAGE);
+    expect(message as string).not.toContain(secret);
+    expect(attributes).toEqual({ requestId: "req-456" });
+  });
+});
+
+/*
+ * The exported options through the REAL express parsers, so the verify
+ * contract (arguments, timing, the parsed body still coming out the other
+ * end) is pinned against body-parser itself and not just against how these
+ * tests call the callbacks.
+ */
+describe("options through the real express parsers", () => {
+  type StreamRequestFactory = (
+    body: string,
+    contentType: string,
+  ) => OneUptimeRequest;
+
+  const createStreamRequest: StreamRequestFactory = (
+    body: string,
+    contentType: string,
+  ): OneUptimeRequest => {
+    const readable: Readable = new Readable({
+      read(): void {},
+    });
+    readable.push(Buffer.from(body, "utf8"));
+    readable.push(null);
+
+    const req: OneUptimeRequest = readable as unknown as OneUptimeRequest;
+    req.headers = {
+      "content-type": contentType,
+      "content-length": String(Buffer.byteLength(body, "utf8")),
+    };
+
+    return req;
+  };
+
+  type MiddlewareRunner = (
+    middleware: RequestHandler,
+    req: OneUptimeRequest,
+  ) => Promise<void>;
+
+  const runMiddleware: MiddlewareRunner = (
+    middleware: RequestHandler,
+    req: OneUptimeRequest,
+  ): Promise<void> => {
+    return new Promise<void>(
+      (resolve: () => void, reject: (reason: unknown) => void) => {
+        middleware(req, {} as ExpressResponse, (err?: unknown): void => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve();
+        });
+      },
+    );
+  };
+
+  test("urlencoded: parses the body AND captures one raw copy on both fields", async () => {
+    const body: string = "a=1&b=2&name=Gr%C3%BC%C3%9Fe";
+    const req: OneUptimeRequest = createStreamRequest(
+      body,
+      "application/x-www-form-urlencoded",
+    );
+    const middleware: RequestHandler = ExpressUrlEncoded(
+      urlEncodedBodyParserOptions,
+    ) as RequestHandler;
+
+    await runMiddleware(middleware, req);
+
+    expect(req.body).toEqual({ a: "1", b: "2", name: "Grüße" });
+    expect(req.rawBody).toBe(body);
+    expect(req.rawFormUrlEncodedBody).toBe(body);
+    expect(debugSpy.mock.calls).toHaveLength(1);
+    expect(debugSpy.mock.calls[0]![0]).toBe(URL_ENCODED_DEBUG_MESSAGE);
+  });
+
+  test("json: parses the body AND captures the raw copy on rawBody", async () => {
+    const body: string = '{"a":1,"city":"東京"}';
+    const req: OneUptimeRequest = createStreamRequest(body, "application/json");
+    const middleware: RequestHandler = ExpressJson(
+      jsonBodyParserOptions,
+    ) as RequestHandler;
+
+    await runMiddleware(middleware, req);
+
+    expect(req.body).toEqual({ a: 1, city: "東京" });
+    expect(req.rawBody).toBe(body);
+    expect(req.rawFormUrlEncodedBody).toBeUndefined();
+    expect(debugSpy.mock.calls).toHaveLength(1);
+    expect(debugSpy.mock.calls[0]![0]).toBe(JSON_DEBUG_MESSAGE);
+  });
+});
+
+/*
+ * Read rather than executed, following VendorAssets.test.ts: what matters is
+ * only that StartServer builds its middlewares from these exact exported
+ * option objects, so the behavioral tests above are testing what production
+ * actually runs.
+ */
+describe("StartServer wires the exported options into its middlewares", () => {
+  const startServerSource: string = fs.readFileSync(
+    path.resolve(
+      __dirname,
+      "..",
+      "..",
+      "..",
+      "Server",
+      "Utils",
+      "StartServer.ts",
+    ),
+    "utf8",
+  );
+
+  test("json middleware is built from jsonBodyParserOptions", () => {
+    expect(startServerSource).toMatch(
+      /ExpressJson\(\s*jsonBodyParserOptions,?\s*\)/,
+    );
+  });
+
+  test("urlencoded middleware is built from urlEncodedBodyParserOptions", () => {
+    expect(startServerSource).toMatch(
+      /ExpressUrlEncoded\(\s*urlEncodedBodyParserOptions,?\s*\)/,
+    );
+  });
+
+  /*
+   * Large probe payloads depend on the 50mb limit; the express default is
+   * 100kb, so a transcription slip in these exported objects would reject
+   * real traffic while every tiny-body test here still passes.
+   */
+  test("both option objects keep the 50mb limit and extended parsing", () => {
+    for (const options of [
+      jsonBodyParserOptions,
+      urlEncodedBodyParserOptions,
+    ]) {
+      expect(options.limit).toBe("50mb");
+      expect(options.extended).toBe(true);
+      expect(typeof options.verify).toBe("function");
+    }
+  });
+});

package/Tests/Server/Utils/StatusPageSearchEngineIndexing.test.ts

@@ -0,0 +1,60 @@
+/**
+ * The X-Robots-Tag half of the status page indexing opt-out.
+ *
+ * The meta tag in index.ejs only covers the HTML. This header is what carries
+ * the same instruction on the responses that have no <head> to put a tag in -
+ * the RSS feed and llms.txt - so it is tested on its own.
+ */
+
+import applyStatusPageRobotsHeader from "../../../Server/Utils/StatusPageSearchEngineIndexing";
+import { ExpressResponse } from "../../../Server/Utils/Express";
+import { describe, expect, jest, test } from "@jest/globals";
+
+type FakeResponse = {
+  set: ReturnType<typeof jest.fn>;
+  headersSent: boolean;
+};
+
+function fakeResponse(headersSent: boolean = false): FakeResponse {
+  return {
+    set: jest.fn(),
+    headersSent,
+  };
+}
+
+describe("applyStatusPageRobotsHeader", () => {
+  test("sends noindex, nofollow when the owner turned indexing off", () => {
+    const res: FakeResponse = fakeResponse();
+
+    applyStatusPageRobotsHeader(res as unknown as ExpressResponse, false);
+
+    expect(res.set).toHaveBeenCalledTimes(1);
+    expect(res.set).toHaveBeenCalledWith("X-Robots-Tag", "noindex, nofollow");
+  });
+
+  test("sends no header at all when indexing is on", () => {
+    /*
+     * Not "sends index, follow". Emitting the default explicitly would
+     * overwrite a noindex that an operator set in front of OneUptime - a CDN
+     * rule or an ingress annotation - because the last writer of a header
+     * wins. Silence leaves those in place.
+     */
+    const res: FakeResponse = fakeResponse();
+
+    applyStatusPageRobotsHeader(res as unknown as ExpressResponse, true);
+
+    expect(res.set).not.toHaveBeenCalled();
+  });
+
+  test("does not touch a response that has already been flushed", () => {
+    /*
+     * Node drops headers set after the response has gone out, and logs
+     * nothing. Guarding here keeps a late caller from thinking it succeeded.
+     */
+    const res: FakeResponse = fakeResponse(true);
+
+    applyStatusPageRobotsHeader(res as unknown as ExpressResponse, false);
+
+    expect(res.set).not.toHaveBeenCalled();
+  });
+});