@oneuptime/common 12.0.12 → 12.0.14

package/Tests/Server/Services/TeamMemberInviteRegistrationToken.test.ts

@@ -0,0 +1,290 @@
+import EmailVerificationToken from "../../../Models/DatabaseModels/EmailVerificationToken";
+import Project from "../../../Models/DatabaseModels/Project";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import User from "../../../Models/DatabaseModels/User";
+import DatabaseConfig from "../../../Server/DatabaseConfig";
+import EmailVerificationTokenService from "../../../Server/Services/EmailVerificationTokenService";
+import MailService from "../../../Server/Services/MailService";
+import ProjectSCIMService from "../../../Server/Services/ProjectSCIMService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import TeamMemberService from "../../../Server/Services/TeamMemberService";
+import UserNotificationRuleService from "../../../Server/Services/UserNotificationRuleService";
+import UserNotificationSettingService from "../../../Server/Services/UserNotificationSettingService";
+import UserService from "../../../Server/Services/UserService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import Hostname from "../../../Types/API/Hostname";
+import Protocol from "../../../Types/API/Protocol";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Email from "../../../Types/Email";
+import EmailMessage from "../../../Types/Email/EmailMessage";
+import HashedString from "../../../Types/HashedString";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * The invitation half of GHSA-qg84-6hrg-mr5g.
+ *
+ * Inviting somebody creates their User row with no password on it, and /signup
+ * used to hand that row to anyone who asked for it by address. The address is
+ * not a secret -- corporate ones are guessable by construction -- so the
+ * invitation now carries a registration token, and that token is the only thing
+ * that can claim the account.
+ *
+ * Which means the invitation email is the sole delivery channel for it, and the
+ * decision of whether to mint one has to key off "has this person registered
+ * yet", not "did we just create their row". Those two came apart for anyone
+ * invited to a second project before they ever signed up: they had a row, so
+ * they were treated as an existing user and sent a sign-in link they could not
+ * use, having no password to sign in with.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const TEAM_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const USER_ID: ObjectID = new ObjectID("33333333-3333-4333-8333-333333333333");
+const INVITER_ID: ObjectID = new ObjectID(
+  "55555555-5555-4555-8555-555555555555",
+);
+
+const MEMBER_EMAIL: Email = new Email("alice@company.com");
+
+let sendMailSpy: jest.SpyInstance;
+let createTokenSpy: jest.SpyInstance;
+let findUserSpy: jest.SpyInstance;
+
+// Calls a protected hook without widening the service's public surface.
+function callHook(
+  service: unknown,
+  name: string,
+  ...args: Array<unknown>
+): Promise<unknown> {
+  const hooks: Record<
+    string,
+    (...hookArgs: Array<unknown>) => Promise<unknown>
+  > = service as Record<
+    string,
+    (...hookArgs: Array<unknown>) => Promise<unknown>
+  >;
+
+  return hooks[name]!.apply(service, args);
+}
+
+function inviteBy(): CreateBy<TeamMember> {
+  const member: TeamMember = new TeamMember();
+  member.projectId = PROJECT_ID;
+  member.teamId = TEAM_ID;
+
+  return {
+    data: member,
+    props: {
+      userId: INVITER_ID,
+      tenantId: PROJECT_ID,
+    } as DatabaseCommonInteractionProps,
+    miscDataProps: { email: MEMBER_EMAIL.toString() },
+  } as CreateBy<TeamMember>;
+}
+
+/* Somebody who has an account and can sign in. */
+function registeredUser(): User {
+  const user: User = new User(USER_ID);
+  user._id = USER_ID.toString();
+  user.email = MEMBER_EMAIL;
+  user.password = new HashedString("already-registered", true);
+
+  return user;
+}
+
+/* An invitation that nobody has claimed: a row, and no password on it. */
+function unclaimedUser(): User {
+  const user: User = new User(USER_ID);
+  user._id = USER_ID.toString();
+  user.email = MEMBER_EMAIL;
+
+  return user;
+}
+
+function sentMail(): EmailMessage {
+  expect(sendMailSpy).toHaveBeenCalledTimes(1);
+
+  return sendMailSpy.mock.calls[0]![0] as EmailMessage;
+}
+
+function registerLink(): string {
+  return sentMail().vars["registerLink"] as string;
+}
+
+/* The token actually written to the database for this invitation. */
+function persistedToken(): EmailVerificationToken {
+  expect(createTokenSpy).toHaveBeenCalledTimes(1);
+
+  return createTokenSpy.mock.calls[0]![0]["data"] as EmailVerificationToken;
+}
+
+beforeEach(() => {
+  jest
+    .spyOn(ProjectSCIMService, "countBy")
+    .mockResolvedValue(new PositiveNumber(0));
+
+  // No existing membership - the duplicate-invite guard at the end of the hook.
+  jest.spyOn(TeamMemberService, "findOneBy").mockResolvedValue(null);
+
+  jest
+    .spyOn(ProjectService, "findOneById")
+    .mockResolvedValue({ name: "Acme Production" } as Project);
+
+  jest
+    .spyOn(DatabaseConfig, "getHost")
+    .mockResolvedValue(new Hostname("oneuptime.test"));
+  jest
+    .spyOn(DatabaseConfig, "getHttpProtocol")
+    .mockResolvedValue(Protocol.HTTPS);
+
+  sendMailSpy = jest
+    .spyOn(MailService, "sendMail")
+    .mockResolvedValue(undefined as never);
+
+  createTokenSpy = jest
+    .spyOn(EmailVerificationTokenService, "create")
+    .mockResolvedValue(new EmailVerificationToken());
+
+  findUserSpy = jest
+    .spyOn(UserService, "findOneBy")
+    .mockResolvedValue(unclaimedUser());
+  jest.spyOn(UserService, "findOneById").mockResolvedValue(unclaimedUser());
+  jest.spyOn(UserService, "createByEmail").mockResolvedValue(unclaimedUser());
+
+  jest
+    .spyOn(
+      UserNotificationSettingService,
+      "addDefaultNotificationSettingsForUser",
+    )
+    .mockResolvedValue(undefined as never);
+  jest
+    .spyOn(UserNotificationRuleService, "addDefaultNotificationRuleForUser")
+    .mockResolvedValue(undefined as never);
+
+  jest
+    .spyOn(TeamMemberService, "refreshTokens")
+    .mockResolvedValue(undefined as never);
+  jest
+    .spyOn(
+      TeamMemberService,
+      "updateSubscriptionSeatsByUniqueTeamMembersInProject",
+    )
+    .mockResolvedValue(undefined as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("TeamMemberService.onBeforeCreate - inviting somebody with no account yet", () => {
+  beforeEach(() => {
+    // Nobody by this address: the invite creates the row.
+    findUserSpy.mockResolvedValue(null);
+  });
+
+  test("mints a registration token bound to the invited address", async () => {
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    const token: EmailVerificationToken = persistedToken();
+
+    expect(token.email!.toString()).toBe(MEMBER_EMAIL.toString());
+    expect(token.userId!.toString()).toBe(USER_ID.toString());
+  });
+
+  test("puts that same token on the link in the invitation", async () => {
+    /*
+     * The email is the only place the token is ever published. If the link and
+     * the stored row disagreed, every invitation would dead-end.
+     */
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    expect(registerLink()).toContain(persistedToken().token!.toString());
+  });
+
+  test("sends them to register rather than to sign in", async () => {
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    expect(sentMail().vars["isNewUser"]).toBe("true");
+    expect(registerLink()).toContain("/accounts/register");
+  });
+});
+
+describe("TeamMemberService.onBeforeCreate - inviting somebody who was invited before but never signed up", () => {
+  beforeEach(() => {
+    // The row exists from an earlier invitation, and still has no password.
+    findUserSpy.mockResolvedValue(unclaimedUser());
+  });
+
+  test("still treats them as somebody who has to register", async () => {
+    /*
+     * The regression. Keying off "did we just create the row" called this an
+     * existing user and mailed them a sign-in link for an account that has no
+     * password.
+     */
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    expect(sentMail().vars["isNewUser"]).toBe("true");
+  });
+
+  test("mints them a token, because their account is still claimable", async () => {
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    expect(registerLink()).toContain(persistedToken().token!.toString());
+  });
+
+  test("does not create a second user row for them", async () => {
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    expect(UserService.createByEmail).not.toHaveBeenCalled();
+  });
+});
+
+describe("TeamMemberService.onBeforeCreate - inviting somebody who already has an account", () => {
+  beforeEach(() => {
+    findUserSpy.mockResolvedValue(registeredUser());
+  });
+
+  test("sends them to sign in", async () => {
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    expect(sentMail().vars["isNewUser"]).toBe("false");
+  });
+
+  test("mints no token, because there is nothing left to claim", async () => {
+    /*
+     * A registered account cannot be claimed through /signup at all, so a token
+     * for it would authorize nothing -- it would just be a spare key sitting in
+     * an inbox.
+     */
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    expect(createTokenSpy).not.toHaveBeenCalled();
+  });
+
+  test("the link it does carry has no token on it", async () => {
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    expect(registerLink()).not.toContain("token=");
+  });
+});
+
+describe("TeamMemberService.onBeforeCreate - reading the invitee", () => {
+  test("asks for the password column, since that is what the decision turns on", async () => {
+    /*
+     * findByEmail selects only the id. Reading the invitee with it would make
+     * `user.password` undefined for everyone, and every invitation would mint a
+     * token -- including for accounts that cannot be claimed.
+     */
+    await callHook(TeamMemberService, "onBeforeCreate", inviteBy());
+
+    const select: Record<string, unknown> = findUserSpy.mock.calls[0]![0][
+      "select"
+    ] as Record<string, unknown>;
+
+    expect(select["password"]).toBe(true);
+  });
+});

package/Tests/Server/Services/TelemetryResourceFacetFilters.test.ts

@@ -0,0 +1,267 @@
+/*
+ * The identifier lookup is stubbed: these tests are about what the SQL and
+ * the rewritten query look like, and leaving it live would make them depend
+ * on a reachable Postgres.
+ */
+const kubernetesClusterFindBy: jest.Mock = jest.fn();
+
+jest.mock("../../../Server/Services/KubernetesClusterService", () => {
+  return { __esModule: true, default: { findBy: kubernetesClusterFindBy } };
+});
+
+import LogAggregationService from "../../../Server/Services/LogAggregationService";
+import TraceAggregationService from "../../../Server/Services/TraceAggregationService";
+import LogService from "../../../Server/Services/LogService";
+import SpanService from "../../../Server/Services/SpanService";
+import { Results } from "../../../Server/Services/AnalyticsDatabaseService";
+import { Statement } from "../../../Server/Utils/AnalyticsDatabase/Statement";
+import { ResourceEntityScope } from "../../../Server/Utils/Telemetry/ResourceEntityFilter";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import { keyForKubernetesCluster } from "../../../Utils/Telemetry/EntityKey";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * End of the read path for issue #3216. Selecting a Kubernetes cluster used to
+ * compile to `primaryEntityId = '<clusterId>'`, and OTLP telemetry that
+ * carries a `service.name` is primary-keyed on its SERVICE — the cluster only
+ * appears in `entityKeys`. So the predicate matched zero rows, and pairing the
+ * cluster with a service made results reappear because both ids shared one
+ * `IN (...)` list.
+ *
+ * These tests pin the two surfaces that have to agree on what a resource facet
+ * selects: the aggregation statements behind the histogram / facets / analytics
+ * panels, and the list query the rows themselves come from. A chart that
+ * disagrees with its list is its own bug.
+ */
+
+const projectId: ObjectID = ObjectID.generate();
+const startTime: Date = new Date("2026-08-14T11:00:00.000Z");
+const endTime: Date = new Date("2026-08-14T12:00:00.000Z");
+
+const clusterId: string = ObjectID.generate().toString();
+const serviceId: string = ObjectID.generate().toString();
+const clusterEntityKey: string = keyForKubernetesCluster(
+  projectId.toString(),
+  "prod-eu",
+);
+
+const clusterScope: ResourceEntityScope = {
+  entityIds: [clusterId],
+  entityKeys: [clusterEntityKey],
+  attributeKey: "resource.k8s.cluster.name",
+  attributeValues: ["prod-eu"],
+};
+
+/*
+ * Capture the statements a service builds instead of running them. The
+ * assertions are about the SQL shape (which branches, how they are combined),
+ * which is what decides whether a row matches.
+ */
+function captureStatements(
+  service: { executeQuery: (statement: Statement) => Promise<Results> },
+  rows: Array<JSONObject> = [],
+): Array<Statement> {
+  const captured: Array<Statement> = [];
+
+  jest.spyOn(service as never, "executeQuery").mockImplementation(((
+    statement: Statement,
+  ): Promise<Results> => {
+    captured.push(statement);
+
+    return Promise.resolve({
+      json: (): Promise<unknown> => {
+        return Promise.resolve({ data: rows });
+      },
+    } as unknown as Results);
+  }) as never);
+
+  return captured;
+}
+
+describe("resource facet filters reach the telemetry read path", () => {
+  beforeEach(() => {
+    kubernetesClusterFindBy.mockReset();
+    kubernetesClusterFindBy.mockResolvedValue([
+      { clusterIdentifier: "prod-eu" },
+    ]);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("LogAggregationService", () => {
+    test("the histogram matches a cluster by entity key, not only by primaryEntityId", async () => {
+      const captured: Array<Statement> = captureStatements(LogService);
+
+      await LogAggregationService.getHistogram({
+        projectId,
+        startTime,
+        endTime,
+        bucketSizeInMinutes: 5,
+        resourceScopes: [clusterScope],
+      });
+
+      const query: string = captured[0]!.query;
+
+      expect(query).toContain("primaryEntityId IN");
+      expect(query).toContain("hasAny(entityKeys,");
+      expect(query).toContain("attributes[");
+      expect(Object.values(captured[0]!.query_params)).toContainEqual([
+        clusterEntityKey,
+      ]);
+    });
+
+    test("a cluster and a service are separate predicates, so they intersect", async () => {
+      const captured: Array<Statement> = captureStatements(LogService);
+
+      await LogAggregationService.getHistogram({
+        projectId,
+        startTime,
+        endTime,
+        bucketSizeInMinutes: 5,
+        serviceIds: [new ObjectID(serviceId)],
+        resourceScopes: [clusterScope],
+      });
+
+      const query: string = captured[0]!.query;
+
+      /*
+       * Two AND-ed predicates. Before the fix both ids went into ONE
+       * `primaryEntityId IN (...)`, which OR-ed them — that is why adding a
+       * service "fixed" the empty result while dropping the cluster.
+       */
+      expect(query).toContain("AND primaryEntityId IN");
+      expect(query).toContain("AND (primaryEntityId IN");
+      expect(query).toContain("hasAny(entityKeys,");
+    });
+
+    test("facet value queries carry the same scope as the histogram", async () => {
+      const captured: Array<Statement> = captureStatements(LogService);
+
+      await LogAggregationService.getFacetValues({
+        projectId,
+        startTime,
+        endTime,
+        facetKey: "severityText",
+        resourceScopes: [clusterScope],
+      });
+
+      expect(captured[0]!.query).toContain("hasAny(entityKeys,");
+    });
+
+    test("no resource scope leaves the statement exactly as it was", async () => {
+      const captured: Array<Statement> = captureStatements(LogService);
+
+      await LogAggregationService.getHistogram({
+        projectId,
+        startTime,
+        endTime,
+        bucketSizeInMinutes: 5,
+      });
+
+      expect(captured[0]!.query).not.toContain("hasAny(entityKeys,");
+      expect(captured[0]!.query).not.toContain("AND (primaryEntityId IN");
+    });
+  });
+
+  describe("TraceAggregationService", () => {
+    test("the span histogram matches a cluster by entity key too", async () => {
+      const captured: Array<Statement> = captureStatements(SpanService);
+
+      await TraceAggregationService.getHistogram({
+        projectId,
+        startTime,
+        endTime,
+        bucketSizeInMinutes: 5,
+        resourceScopes: [clusterScope],
+      });
+
+      const query: string = captured[0]!.query;
+
+      expect(query).toContain("primaryEntityId IN");
+      expect(query).toContain("hasAny(entityKeys,");
+    });
+
+    test("no resource scope leaves the span statement unchanged", async () => {
+      const captured: Array<Statement> = captureStatements(SpanService);
+
+      await TraceAggregationService.getHistogram({
+        projectId,
+        startTime,
+        endTime,
+        bucketSizeInMinutes: 5,
+      });
+
+      expect(captured[0]!.query).not.toContain("hasAny(entityKeys,");
+    });
+  });
+
+  describe("list queries", () => {
+    /*
+     * The list runs through the generic analytics endpoint, so the ids the
+     * explorer sends have to be resolved in the service's own onBeforeFind
+     * hook — that is the last point where Postgres is still reachable.
+     */
+    type FindByShape = {
+      query: Record<string, unknown>;
+      props: { tenantId: ObjectID };
+    };
+
+    test("LogService resolves the explorer's resource ids before compiling", async () => {
+      const findBy: FindByShape = {
+        query: { resourceFilters: { kubernetesClusterId: [clusterId] } },
+        props: { tenantId: projectId },
+      };
+
+      await (
+        LogService as unknown as {
+          onBeforeFind: (input: FindByShape) => Promise<unknown>;
+        }
+      ).onBeforeFind(findBy);
+
+      expect(findBy.query["resourceFilters"]).toBeUndefined();
+      expect(findBy.query["resourceEntityScopes"]).toBeDefined();
+
+      const scopes: Array<ResourceEntityScope> = findBy.query[
+        "resourceEntityScopes"
+      ] as Array<ResourceEntityScope>;
+
+      expect(scopes[0]!.entityIds).toEqual([clusterId]);
+      // Resolved through Postgres to the key ingest stamped on the rows.
+      expect(scopes[0]!.entityKeys).toEqual([clusterEntityKey]);
+    });
+
+    test("SpanService resolves them the same way", async () => {
+      const findBy: FindByShape = {
+        query: { resourceFilters: { kubernetesClusterId: [clusterId] } },
+        props: { tenantId: projectId },
+      };
+
+      await (
+        SpanService as unknown as {
+          onBeforeFind: (input: FindByShape) => Promise<unknown>;
+        }
+      ).onBeforeFind(findBy);
+
+      expect(findBy.query["resourceFilters"]).toBeUndefined();
+      expect(findBy.query["resourceEntityScopes"]).toBeDefined();
+    });
+
+    test("a query without resource filters is handed through untouched", async () => {
+      const findBy: FindByShape = {
+        query: { severityText: "Error" },
+        props: { tenantId: projectId },
+      };
+
+      await (
+        LogService as unknown as {
+          onBeforeFind: (input: FindByShape) => Promise<unknown>;
+        }
+      ).onBeforeFind(findBy);
+
+      expect(findBy.query).toEqual({ severityText: "Error" });
+    });
+  });
+});