@oneuptime/common 12.0.12 → 12.0.14

package/Tests/Server/Utils/PrivacyFilterUtil.test.ts

@@ -38,6 +38,70 @@ describe("combineWithPrivacyClause", () => {
     expect(children[1]).toBe(clause);
   });
 
+  it("keeps nested ObjectID values as UUID strings after database transformation", () => {
+    /*
+     * The clause this function builds lands on an ObjectID column
+     * (incidentId, alertId, the episode ids, an ownedThrough FK), and those
+     * columns carry ObjectID.getDatabaseTransformer(). TypeORM hands each
+     * child of the And() to that transformer, so a transformer that cannot
+     * cope with an operator replaces the caller's own equality with
+     * "[object Object]" — which Postgres then rejects for a uuid column with
+     * 22P02, i.e. a 500 on the incident/alert Feed, Internal Notes and Owners
+     * reads for anyone who is not a project owner or admin.
+     * https://github.com/OneUptime/oneuptime/issues/2497
+     */
+    const incidentId: ObjectID = ObjectID.generate();
+    const clause: FindOperatorType = makePrivacyClause();
+    const combined: any = combineWithPrivacyClause(incidentId, clause as any);
+
+    const transformed: any = ObjectID.getDatabaseTransformer().to(combined);
+
+    expect(transformed).toBeInstanceOf(FindOperator);
+    expect(transformed.type).toBe("and");
+    expect(transformed.value[0]).toBeInstanceOf(FindOperator);
+    expect(transformed.value[0].type).toBe("equal");
+    expect(transformed.value[0].value).toBe(incidentId.toString());
+    expect(transformed.value[0].value).not.toBe("[object Object]");
+    expect(transformed.value[1]).toBe(clause);
+  });
+
+  it("survives the transformation twice, as findBy then countBy would", () => {
+    /*
+     * BaseAPI.getList hands the same query object to findBy and then countBy,
+     * and the transformer mutates the operator in place.
+     */
+    const incidentId: ObjectID = ObjectID.generate();
+    const clause: FindOperatorType = makePrivacyClause();
+    const combined: any = combineWithPrivacyClause(incidentId, clause as any);
+
+    ObjectID.getDatabaseTransformer().to(combined);
+    const transformed: any = ObjectID.getDatabaseTransformer().to(combined);
+
+    expect(transformed.value[0].value).toBe(incidentId.toString());
+  });
+
+  it("keeps a re-combined clause intact when the privacy filter runs twice", () => {
+    /*
+     * countBy's hook sees the And that findBy's hook already built and wraps
+     * it again, so the operator handed to the transformer is And(And(...)).
+     */
+    const incidentId: ObjectID = ObjectID.generate();
+    const firstClause: FindOperatorType = makePrivacyClause();
+    const secondClause: FindOperatorType = makePrivacyClause();
+
+    const once: any = combineWithPrivacyClause(incidentId, firstClause as any);
+    const twice: any = combineWithPrivacyClause(once, secondClause as any);
+
+    const transformed: any = ObjectID.getDatabaseTransformer().to(twice);
+
+    expect(transformed.type).toBe("and");
+    expect(transformed.value[0]).toBe(once);
+    expect(transformed.value[0].type).toBe("and");
+    expect(transformed.value[0].value[0].value).toBe(incidentId.toString());
+    expect(transformed.value[0].value[1]).toBe(firstClause);
+    expect(transformed.value[1]).toBe(secondClause);
+  });
+
   it("ANDs an existing string equality with the privacy clause", () => {
     const clause: FindOperatorType = makePrivacyClause();
     const combined: any = combineWithPrivacyClause("some-id", clause as any);

package/Tests/Server/Utils/PushNotificationUtilCreators.test.ts

@@ -0,0 +1,267 @@
+import PushNotificationUtil from "../../../Server/Utils/PushNotificationUtil";
+import PushNotificationMessage from "../../../Types/PushNotification/PushNotificationMessage";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Behavioural coverage for the PushNotificationUtil creators that the sibling
+ * PushNotificationUtil.test.ts does not touch. Each creator is a pure builder,
+ * but each carries real display logic a responder sees on a locked screen:
+ * which identifier the title shows (a prefixed number, a bare #number, or just
+ * the title), whether a note reads as Private or Public, and whether a click
+ * target is wired through. A regression in any of these is a page that opens
+ * the wrong thing or leaks the wrong label, so they are pinned here.
+ */
+
+describe("PushNotificationUtil untested creators", () => {
+  describe("defaults are applied to every creator", () => {
+    test("icon and badge are stamped on by applyDefaults", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyAddedNotification({
+          policyName: "Primary",
+        });
+
+      expect(message.icon).toBe(PushNotificationUtil.DEFAULT_ICON);
+      expect(message.badge).toBe(PushNotificationUtil.DEFAULT_BADGE);
+    });
+  });
+
+  describe("createAlertCreatedNotification - display number precedence", () => {
+    test("a prefixed number wins over a bare number in title and body", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertCreatedNotification({
+          alertTitle: "Disk full",
+          projectName: "Acme",
+          alertViewLink: "https://x/alert/1",
+          alertNumber: 12,
+          alertNumberWithPrefix: "ALERT-12",
+          alertId: "a1",
+          projectId: "p1",
+        });
+
+      expect(message.title).toBe("New Alert ALERT-12: Disk full");
+      expect(message.body).toContain("ALERT-12 (Disk full)");
+      expect(message.body).toContain("in Acme");
+    });
+
+    test("a bare number is rendered as #number when no prefix is given", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertCreatedNotification({
+          alertTitle: "Disk full",
+          projectName: "Acme",
+          alertViewLink: "https://x/alert/1",
+          alertNumber: 12,
+        });
+
+      expect(message.title).toBe("New Alert #12: Disk full");
+      expect(message.body).toContain("#12 (Disk full)");
+    });
+
+    test("with neither number the identifier is just the title", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertCreatedNotification({
+          alertTitle: "Disk full",
+          projectName: "Acme",
+          alertViewLink: "https://x/alert/1",
+        });
+
+      expect(message.title).toBe("New Alert: Disk full");
+      // No leading space and no parenthesised number when there is no number.
+      expect(message.body).toContain("created: Disk full in Acme");
+      expect(message.title).not.toContain("  ");
+    });
+
+    test("wires clickAction, url and requireInteraction, and carries the payload", () => {
+      const link: string = "https://dashboard/alert/42";
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertCreatedNotification({
+          alertTitle: "Disk full",
+          projectName: "Acme",
+          alertViewLink: link,
+          alertId: "a42",
+          projectId: "p9",
+        });
+
+      expect(message.clickAction).toBe(link);
+      expect(message.url).toBe(link);
+      expect(message.requireInteraction).toBe(true);
+      expect(message.tag).toBe("alert-created");
+      expect(message.data).toMatchObject({
+        type: "alert-created",
+        entityType: "alert",
+        entityId: "a42",
+        projectId: "p9",
+        url: link,
+      });
+    });
+  });
+
+  describe("createAlertEpisodeCreatedNotification", () => {
+    test("uses the alert-episode tag, title and payload type", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertEpisodeCreatedNotification({
+          alertEpisodeTitle: "Cascade",
+          projectName: "Acme",
+          alertEpisodeViewLink: "https://x/ep/1",
+          episodeNumberWithPrefix: "EP-3",
+        });
+
+      expect(message.title).toBe("New Alert Episode EP-3: Cascade");
+      expect(message.tag).toBe("alert-episode-created");
+      expect(message.data).toMatchObject({
+        type: "alert-episode-created",
+        entityType: "alert-episode",
+      });
+    });
+  });
+
+  describe("createIncidentEpisodeCreatedNotification", () => {
+    test("uses the incident-episode tag and title", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentEpisodeCreatedNotification({
+          incidentEpisodeTitle: "Cascade",
+          projectName: "Acme",
+          incidentEpisodeViewLink: "https://x/ep/1",
+          episodeNumber: 7,
+        });
+
+      expect(message.title).toBe("New Incident Episode #7: Cascade");
+      expect(message.tag).toBe("incident-episode-created");
+      expect(message.data).toMatchObject({
+        type: "incident-episode-created",
+        entityType: "incident-episode",
+      });
+    });
+  });
+
+  describe("createIncidentNotePostedNotification - note visibility", () => {
+    test("a private note reads as Private in title, body and payload", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentNotePostedNotification({
+          incidentTitle: "API down",
+          projectName: "Acme",
+          isPrivateNote: true,
+          incidentViewLink: "https://x/i/1",
+          incidentNumberWithPrefix: "INC-5",
+        });
+
+      expect(message.title).toBe(
+        "Private Note Added: Incident INC-5 - API down",
+      );
+      expect(message.body).toContain("A private note has been posted");
+      expect(message.data).toMatchObject({ isPrivateNote: true });
+    });
+
+    test("a public note reads as Public - the visibility is not swapped", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentNotePostedNotification({
+          incidentTitle: "API down",
+          projectName: "Acme",
+          isPrivateNote: false,
+          incidentViewLink: "https://x/i/1",
+        });
+
+      expect(message.title).toContain("Public Note Added");
+      expect(message.body).toContain("A public note has been posted");
+      expect(message.data).toMatchObject({ isPrivateNote: false });
+    });
+  });
+
+  describe("on-call policy membership notifications", () => {
+    test("added names the policy and uses the added tag", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyAddedNotification({
+          policyName: "Primary",
+        });
+
+      expect(message.title).toBe("Added to On-Call Policy");
+      expect(message.body).toContain(
+        "added to the on-call duty policy Primary",
+      );
+      expect(message.tag).toBe("on-call-policy-added");
+      expect(message.requireInteraction).toBe(false);
+    });
+
+    test("removed names the policy and uses the removed tag", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyRemovedNotification({
+          policyName: "Primary",
+        });
+
+      expect(message.title).toBe("Removed from On-Call Policy");
+      expect(message.body).toContain(
+        "removed from the on-call duty policy Primary",
+      );
+      expect(message.tag).toBe("on-call-policy-removed");
+    });
+
+    test("added and removed are distinguishable - different title, body and tag", () => {
+      const added: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyAddedNotification({
+          policyName: "Primary",
+        });
+      const removed: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyRemovedNotification({
+          policyName: "Primary",
+        });
+
+      expect(added.title).not.toBe(removed.title);
+      expect(added.body).not.toBe(removed.body);
+      expect(added.tag).not.toBe(removed.tag);
+    });
+  });
+
+  describe("createProbeStatusChangedNotification - the conditional click target", () => {
+    test("without a clickAction, no url/clickAction is wired", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeStatusChangedNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "connected",
+        });
+
+      expect(message.title).toBe("Probe connected: eu-west");
+      expect(message.clickAction).toBeUndefined();
+      expect(message.url).toBeUndefined();
+      expect(message.data).not.toHaveProperty("url");
+    });
+
+    test("with a clickAction, it is mirrored onto url and into the payload", () => {
+      const link: string = "https://dashboard/probe/eu-west";
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeStatusChangedNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "disconnected",
+          clickAction: link,
+        });
+
+      expect(message.title).toBe("Probe disconnected: eu-west");
+      expect(message.clickAction).toBe(link);
+      expect(message.url).toBe(link);
+      expect(message.data).toMatchObject({ url: link });
+    });
+  });
+
+  describe("createMonitorProbeStatusNotification", () => {
+    test("passes title/body/tag straight through and stamps the type", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createMonitorProbeStatusNotification({
+          title: "Monitor degraded",
+          body: "eu-west probe cannot reach API",
+          tag: "monitor-probe-status-degraded",
+          monitorId: "m1",
+          monitorName: "API",
+        });
+
+      expect(message.title).toBe("Monitor degraded");
+      expect(message.body).toBe("eu-west probe cannot reach API");
+      expect(message.tag).toBe("monitor-probe-status-degraded");
+      expect(message.requireInteraction).toBe(false);
+      expect(message.data).toMatchObject({
+        type: "monitor-probe-status",
+        monitorId: "m1",
+        monitorName: "API",
+      });
+    });
+  });
+});

package/Tests/Server/Utils/SessionReplay/SessionReplayGateCacheStore.test.ts

@@ -0,0 +1,207 @@
+import ObjectID from "../../../../Types/ObjectID";
+
+/*
+ * The policy cache is keyed by projectId plus a CLIENT-supplied appIdentifier,
+ * so anyone holding an ingestion key (which ships in public browser JS) can
+ * mint unlimited distinct keys. These tests pin that the store is bounded -
+ * the regression they guard is the unbounded module-level Map that grew until
+ * the ingest pod was OOM-killed - while preserving the store's contracts:
+ * negative (null-policy) caching, per-project prefix invalidation, and the
+ * kill marker that must always land even at capacity.
+ */
+
+jest.mock("../../../../Server/Infrastructure/Redis", () => {
+  return {
+    __esModule: true,
+    default: {
+      getClient: jest.fn().mockReturnValue(null),
+      isConnected: jest.fn().mockReturnValue(false),
+    },
+  };
+});
+
+jest.mock("../../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+    },
+  };
+});
+
+import SessionReplayGateCacheStore, {
+  MAX_KILL_KEY_CACHE_ENTRIES,
+  MAX_POLICY_CACHE_ENTRIES,
+  PolicyCacheEntry,
+} from "../../../../Server/Utils/SessionReplay/SessionReplayGateCacheStore";
+
+type TestPolicy = { name: string };
+
+function policyKey(prefix: string, index: number): string {
+  return `${prefix}:app-${index}`;
+}
+
+function fillPolicyCache(prefix: string, count: number): void {
+  for (let i: number = 0; i < count; i++) {
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>(
+      policyKey(prefix, i),
+      { name: `policy-${i}` },
+    );
+  }
+}
+
+describe("SessionReplayGateCacheStore bounded policy cache", (): void => {
+  beforeEach((): void => {
+    jest.clearAllMocks();
+    /* Module-level Maps persist across tests. */
+    SessionReplayGateCacheStore.clearCache();
+  });
+
+  it("evicts the oldest entry instead of growing past the cap under a unique-key flood", (): void => {
+    fillPolicyCache("proj", MAX_POLICY_CACHE_ENTRIES + 1);
+
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", 0),
+      ),
+    ).toBeUndefined();
+
+    const last: PolicyCacheEntry<TestPolicy> | undefined =
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", MAX_POLICY_CACHE_ENTRIES),
+      );
+    expect(last).toBeDefined();
+    expect(last?.policy).toEqual({
+      name: `policy-${MAX_POLICY_CACHE_ENTRIES}`,
+    });
+  }, 15000);
+
+  it("rewriting an existing key at capacity evicts nothing", (): void => {
+    fillPolicyCache("proj", MAX_POLICY_CACHE_ENTRIES);
+
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>(
+      policyKey("proj", 5),
+      { name: "rewritten" },
+    );
+
+    for (let i: number = 0; i < MAX_POLICY_CACHE_ENTRIES; i++) {
+      expect(
+        SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+          policyKey("proj", i),
+        ),
+      ).toBeDefined();
+    }
+
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", 5),
+      )?.policy,
+    ).toEqual({ name: "rewritten" });
+  }, 15000);
+
+  it("a rewrite refreshes recency, so the next eviction takes the stale key", (): void => {
+    fillPolicyCache("proj", MAX_POLICY_CACHE_ENTRIES);
+
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>(
+      policyKey("proj", 0),
+      { name: "refreshed" },
+    );
+
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>("proj:app-new", {
+      name: "new",
+    });
+
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", 1),
+      ),
+    ).toBeUndefined();
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+        policyKey("proj", 0),
+      )?.policy,
+    ).toEqual({ name: "refreshed" });
+    expect(
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>("proj:app-new"),
+    ).toBeDefined();
+  }, 15000);
+
+  it("still caches null policies - the hot-path refusal must stay cached", (): void => {
+    SessionReplayGateCacheStore.setPolicyEntry<TestPolicy>(
+      "proj:app-none",
+      null,
+    );
+
+    const entry: PolicyCacheEntry<TestPolicy> | undefined =
+      SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>("proj:app-none");
+
+    expect(entry).toBeDefined();
+    expect(entry?.policy).toBeNull();
+    expect(typeof entry?.loadedAt).toBe("number");
+  });
+
+  it("clearCache(projectId) deletes exactly that project's prefixed entries after evictions", (): void => {
+    const projectA: ObjectID = ObjectID.generate();
+    const projectB: ObjectID = ObjectID.generate();
+
+    fillPolicyCache(projectA.toString(), MAX_POLICY_CACHE_ENTRIES);
+    /* These writes evict projectA's oldest entries. */
+    fillPolicyCache(projectB.toString(), 5);
+
+    SessionReplayGateCacheStore.clearCache(projectA);
+
+    for (let i: number = 0; i < MAX_POLICY_CACHE_ENTRIES; i++) {
+      expect(
+        SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+          policyKey(projectA.toString(), i),
+        ),
+      ).toBeUndefined();
+    }
+
+    for (let i: number = 0; i < 5; i++) {
+      expect(
+        SessionReplayGateCacheStore.getPolicyEntry<TestPolicy>(
+          policyKey(projectB.toString(), i),
+        ),
+      ).toBeDefined();
+    }
+  }, 15000);
+});
+
+describe("SessionReplayGateCacheStore bounded kill-key cache", (): void => {
+  beforeEach((): void => {
+    jest.clearAllMocks();
+    SessionReplayGateCacheStore.clearCache();
+  });
+
+  it("the local kill marker always lands, even at capacity", async (): Promise<void> => {
+    /* Redis is absent, so the fail-open path caches isDisabled:false. */
+    for (let i: number = 0; i < MAX_KILL_KEY_CACHE_ENTRIES; i++) {
+      await SessionReplayGateCacheStore.isProjectKilled(ObjectID.generate());
+    }
+
+    const killedProject: ObjectID = ObjectID.generate();
+    await SessionReplayGateCacheStore.markProjectDisabled(killedProject);
+
+    expect(
+      await SessionReplayGateCacheStore.isProjectKilled(killedProject),
+    ).toBe(true);
+  }, 30000);
+
+  it("an evicted kill entry re-resolves through the normal path", async (): Promise<void> => {
+    const firstProject: ObjectID = ObjectID.generate();
+    await SessionReplayGateCacheStore.isProjectKilled(firstProject);
+
+    /* Push the first project's entry out of the bounded map. */
+    for (let i: number = 0; i < MAX_KILL_KEY_CACHE_ENTRIES; i++) {
+      await SessionReplayGateCacheStore.isProjectKilled(ObjectID.generate());
+    }
+
+    await expect(
+      SessionReplayGateCacheStore.isProjectKilled(firstProject),
+    ).resolves.toBe(false);
+  }, 30000);
+});