@oneuptime/common 12.0.12 → 12.0.14

package/Tests/Server/Utils/Workspace/MicrosoftTeamsTeamInstalls.test.ts

@@ -584,9 +584,37 @@ describe("MicrosoftTeamsUtil.removeTeamFromBotActivity", () => {
     });
 
     expect(removeSpy).toHaveBeenCalledTimes(1);
+    /*
+     * Uninstall passes both ids: the bot is already out of the team so the
+     * Graph id cannot be looked up, and records written before it was captured
+     * are only findable by the thread id. TEAM_ID here is a thread id, matching
+     * what channelData.team.id carries.
+     */
     expect(removeSpy).toHaveBeenCalledWith({
       tenantId: TENANT_ID,
-      teamId: TEAM_ID,
+      teamsThreadId: TEAM_ID,
+      graphTeamId: undefined,
+    });
+  });
+
+  test("an uninstall activity that still carries aadGroupId passes it through", async () => {
+    const removeSpy: jest.SpyInstance = jest
+      .spyOn(MicrosoftTeamsUtil, "removeTeamFromProjectAuthTokens")
+      .mockResolvedValue(undefined as never);
+
+    await MicrosoftTeamsUtil.removeTeamFromBotActivity({
+      activity: teamActivity({
+        channelData: {
+          team: { id: TEAM_ID, aadGroupId: "graph-team-1" },
+          tenant: { id: TENANT_ID },
+        },
+      }),
+    });
+
+    expect(removeSpy).toHaveBeenCalledWith({
+      tenantId: TENANT_ID,
+      teamsThreadId: TEAM_ID,
+      graphTeamId: "graph-team-1",
     });
   });
 
@@ -884,7 +912,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: TEAM_ID,
+      teamsThreadId: TEAM_ID,
     });
 
     expect(findBySpy).toHaveBeenCalledWith(
@@ -925,7 +953,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: teamToRemove.id,
+      teamsThreadId: teamToRemove.id,
     });
 
     expect(updateSpy).toHaveBeenCalledTimes(1);
@@ -950,7 +978,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: team.id,
+      teamsThreadId: team.id,
     });
 
     const savedMiscData: MicrosoftTeamsMiscData = getUpdateArgs(updateSpy, 0)
@@ -976,7 +1004,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: TEAM_ID,
+      teamsThreadId: TEAM_ID,
     });
 
     expect(updateSpy).not.toHaveBeenCalled();
@@ -991,7 +1019,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: TEAM_ID,
+      teamsThreadId: TEAM_ID,
     });
 
     expect(updateSpy).not.toHaveBeenCalled();
@@ -1014,7 +1042,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: team.id,
+      teamsThreadId: team.id,
     });
 
     expect(updateSpy).toHaveBeenCalledTimes(3);
@@ -1068,7 +1096,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: team.id,
+      teamsThreadId: team.id,
     });
 
     expect(updateSpy).toHaveBeenCalledTimes(1);
@@ -1104,7 +1132,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: "19:team-aaa@thread.tacv2",
+      teamsThreadId: "19:team-aaa@thread.tacv2",
     });
 
     expect(updateSpy).not.toHaveBeenCalled();
@@ -1120,7 +1148,7 @@ describe("MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens", () => {
 
     await MicrosoftTeamsUtil.removeTeamFromProjectAuthTokens({
       tenantId: "tenant-abc",
-      teamId: team.id,
+      teamsThreadId: team.id,
     });
 
     expect(originalMiscData.installedTeams).toEqual({ [team.id]: team });
@@ -1495,9 +1523,15 @@ describe("MicrosoftTeamsUtil.handleBotMessageActivity - team install backfill wi
     });
 
     expect(spies.captureTeamSpy).toHaveBeenCalledTimes(1);
+    /*
+     * onlyIfMissingOrStale, because this runs on every inbound channel message:
+     * once the team is recorded it must cost one read, not a write plus a
+     * possible Bot Framework call to resolve the group id.
+     */
     expect(spies.captureTeamSpy).toHaveBeenCalledWith({
       activity: activity,
       turnContext: turnContext,
+      onlyIfMissingOrStale: true,
     });
     expect(spies.captureChatSpy).not.toHaveBeenCalled();
   });

package/Tests/Types/API/HostnameFromAuthority.test.ts

@@ -0,0 +1,164 @@
+import Hostname from "../../../Types/API/Hostname";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Hostname.fromAuthority splits a URL authority into a bare host and a real
+ * Port. It exists because URL.fromString hands the WHOLE authority to the
+ * Hostname constructor, so `URL.fromString("https://example.com:8443/")`
+ * yields a hostname of "example.com:8443" and no port at all.
+ *
+ * Anything that reads the structured accessors rather than toString() then
+ * dials a host that does not exist. The SSL Certificate Monitor is one such
+ * consumer, which is why a monitor on a non-443 port could never connect —
+ * see https://github.com/OneUptime/oneuptime/issues/3225.
+ *
+ * fromString() is NOT a substitute: it splits on the FIRST colon, which
+ * mangles every IPv6 literal.
+ */
+describe("Hostname.fromAuthority", () => {
+  describe("host and port", () => {
+    test("splits a trailing port off the host", () => {
+      const hostname: Hostname = Hostname.fromAuthority("example.com:8443");
+
+      expect(hostname.hostname).toBe("example.com");
+      expect(hostname.port?.toNumber()).toBe(8443);
+    });
+
+    test("leaves a bare host without a port", () => {
+      const hostname: Hostname = Hostname.fromAuthority("example.com");
+
+      expect(hostname.hostname).toBe("example.com");
+      expect(hostname.port).toBeUndefined();
+    });
+
+    test("handles localhost with a port", () => {
+      const hostname: Hostname = Hostname.fromAuthority("localhost:5000");
+
+      expect(hostname.hostname).toBe("localhost");
+      expect(hostname.port?.toNumber()).toBe(5000);
+    });
+
+    test("handles an IPv4 literal with a port", () => {
+      const hostname: Hostname = Hostname.fromAuthority("127.0.0.1:8443");
+
+      expect(hostname.hostname).toBe("127.0.0.1");
+      expect(hostname.port?.toNumber()).toBe(8443);
+    });
+
+    test("round-trips back to the original authority", () => {
+      expect(Hostname.fromAuthority("example.com:8443").toString()).toBe(
+        "example.com:8443",
+      );
+      expect(Hostname.fromAuthority("example.com").toString()).toBe(
+        "example.com",
+      );
+    });
+  });
+
+  describe("IPv6 literals", () => {
+    test("keeps a bracketed IPv6 address intact and takes its port", () => {
+      const hostname: Hostname = Hostname.fromAuthority("[::1]:8443");
+
+      expect(hostname.hostname).toBe("[::1]");
+      expect(hostname.port?.toNumber()).toBe(8443);
+    });
+
+    test("keeps a bracketed IPv6 address with no port intact", () => {
+      const hostname: Hostname = Hostname.fromAuthority("[::1]");
+
+      expect(hostname.hostname).toBe("[::1]");
+      expect(hostname.port).toBeUndefined();
+    });
+
+    test("does not split an unbracketed IPv6 literal", () => {
+      /*
+       * Two or more colons cannot be a host:port, so every colon belongs to
+       * the address. fromString would have returned a host of "2001".
+       */
+      const hostname: Hostname = Hostname.fromAuthority("2001:db8::1");
+
+      expect(hostname.hostname).toBe("2001:db8::1");
+      expect(hostname.port).toBeUndefined();
+    });
+
+    test("a full bracketed IPv6 address survives with its port", () => {
+      const hostname: Hostname = Hostname.fromAuthority(
+        "[2001:db8::8a2e:370:7334]:9000",
+      );
+
+      expect(hostname.hostname).toBe("[2001:db8::8a2e:370:7334]");
+      expect(hostname.port?.toNumber()).toBe(9000);
+    });
+  });
+
+  describe("userinfo", () => {
+    test("drops userinfo and keeps the host", () => {
+      const hostname: Hostname = Hostname.fromAuthority(
+        "user:token@hooks.example.com",
+      );
+
+      expect(hostname.hostname).toBe("hooks.example.com");
+      expect(hostname.port).toBeUndefined();
+    });
+
+    test("drops userinfo and keeps host and port", () => {
+      const hostname: Hostname = Hostname.fromAuthority(
+        "user:token@example.com:8443",
+      );
+
+      expect(hostname.hostname).toBe("example.com");
+      expect(hostname.port?.toNumber()).toBe(8443);
+    });
+
+    test("splits on the LAST @, since userinfo may contain one", () => {
+      const hostname: Hostname = Hostname.fromAuthority(
+        "user@name:token@example.com:8443",
+      );
+
+      expect(hostname.hostname).toBe("example.com");
+      expect(hostname.port?.toNumber()).toBe(8443);
+    });
+  });
+
+  describe("malformed input", () => {
+    test("an empty authority yields an empty hostname rather than throwing", () => {
+      expect(Hostname.fromAuthority("").hostname).toBe("");
+    });
+
+    test("a trailing colon with no digits is not treated as a port", () => {
+      const hostname: Hostname = Hostname.fromAuthority("example.com:");
+
+      expect(hostname.hostname).toBe("example.com");
+      expect(hostname.port).toBeUndefined();
+    });
+
+    test("surrounding whitespace is trimmed", () => {
+      const hostname: Hostname = Hostname.fromAuthority("  example.com:443  ");
+
+      expect(hostname.hostname).toBe("example.com");
+      expect(hostname.port?.toNumber()).toBe(443);
+    });
+  });
+
+  describe("contrast with fromString", () => {
+    test("fromString rejects an IPv6 literal that fromAuthority handles", () => {
+      /*
+       * Pinned deliberately: it documents WHY fromAuthority exists, and
+       * guards against someone 'simplifying' one into the other.
+       *
+       * fromString splits on the FIRST colon, so "[::1]:8443" becomes a
+       * host of "[" - which the Hostname setter rejects outright.
+       */
+      expect(Hostname.fromAuthority("[::1]:8443").hostname).toBe("[::1]");
+      expect(() => {
+        return Hostname.fromString("[::1]:8443");
+      }).toThrow();
+    });
+
+    test("both agree on the simple host:port case", () => {
+      expect(Hostname.fromAuthority("example.com:8443").hostname).toBe(
+        Hostname.fromString("example.com:8443").hostname,
+      );
+    });
+  });
+});

package/Tests/Types/AutoRemediation/AutoRemediationSuggestionStatus.test.ts

@@ -0,0 +1,192 @@
+import AutoRemediationSuggestionStatus, {
+  AutoRemediationSuggestionStatusHelper,
+} from "../../../Types/AutoRemediation/AutoRemediationSuggestionStatus";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Contract under test — the lifecycle vocabulary of an auto-remediation
+ * suggestion and the single predicate that splits it into terminal vs open.
+ *
+ * A suggestion is the approvable action object a matched rule attaches to an
+ * incident or alert. isTerminalStatus draws the line between states that can
+ * still be actioned (Planning, Suggested — a human or the executor may yet
+ * move them) and states that are frozen for good (Approved, AutoExecuted,
+ * Dismissed, NoneApplicable). Anything downstream that decides whether to show
+ * an approve/dismiss control, re-run planning, or leave a suggestion alone
+ * relies on this partition being exact — every status classified, none in both
+ * halves.
+ *
+ * The enum is string-valued, so the wire/DB representation of each member is
+ * itself part of the contract: renaming a value would silently orphan rows
+ * persisted under the old string. These tests pin both the string values and
+ * the terminal/open classification.
+ */
+
+/*
+ * The two open (non-terminal) states — still actionable.
+ */
+const OPEN_STATUSES: Array<AutoRemediationSuggestionStatus> = [
+  AutoRemediationSuggestionStatus.Planning,
+  AutoRemediationSuggestionStatus.Suggested,
+];
+
+/*
+ * The four terminal states — frozen, never change again.
+ */
+const TERMINAL_STATUSES: Array<AutoRemediationSuggestionStatus> = [
+  AutoRemediationSuggestionStatus.Approved,
+  AutoRemediationSuggestionStatus.AutoExecuted,
+  AutoRemediationSuggestionStatus.Dismissed,
+  AutoRemediationSuggestionStatus.NoneApplicable,
+];
+
+describe("AutoRemediationSuggestionStatus enum", () => {
+  test("each member's string value matches its name", () => {
+    expect(AutoRemediationSuggestionStatus.Planning).toBe("Planning");
+    expect(AutoRemediationSuggestionStatus.Suggested).toBe("Suggested");
+    expect(AutoRemediationSuggestionStatus.Approved).toBe("Approved");
+    expect(AutoRemediationSuggestionStatus.AutoExecuted).toBe("AutoExecuted");
+    expect(AutoRemediationSuggestionStatus.Dismissed).toBe("Dismissed");
+    expect(AutoRemediationSuggestionStatus.NoneApplicable).toBe(
+      "NoneApplicable",
+    );
+  });
+
+  test("declares exactly six members and no extras", () => {
+    const values: Array<string> = Object.values(
+      AutoRemediationSuggestionStatus,
+    );
+    expect(values).toHaveLength(6);
+    expect(values.slice().sort()).toEqual(
+      [
+        "Approved",
+        "AutoExecuted",
+        "Dismissed",
+        "NoneApplicable",
+        "Planning",
+        "Suggested",
+      ].sort(),
+    );
+  });
+
+  test("all member string values are unique", () => {
+    const values: Array<string> = Object.values(
+      AutoRemediationSuggestionStatus,
+    );
+    const unique: Set<string> = new Set(values);
+    expect(unique.size).toBe(values.length);
+  });
+});
+
+describe("AutoRemediationSuggestionStatusHelper.isTerminalStatus", () => {
+  test.each(TERMINAL_STATUSES)(
+    "returns true for terminal status %s",
+    (status: AutoRemediationSuggestionStatus) => {
+      expect(
+        AutoRemediationSuggestionStatusHelper.isTerminalStatus(status),
+      ).toBe(true);
+    },
+  );
+
+  test.each(OPEN_STATUSES)(
+    "returns false for open status %s",
+    (status: AutoRemediationSuggestionStatus) => {
+      expect(
+        AutoRemediationSuggestionStatusHelper.isTerminalStatus(status),
+      ).toBe(false);
+    },
+  );
+
+  test("terminal and open sets together cover every enum member with no overlap", () => {
+    const allStatuses: Array<AutoRemediationSuggestionStatus> = Object.values(
+      AutoRemediationSuggestionStatus,
+    );
+    const partitioned: Array<AutoRemediationSuggestionStatus> = [
+      ...TERMINAL_STATUSES,
+      ...OPEN_STATUSES,
+    ];
+
+    /*
+     * No status appears in both halves.
+     */
+    expect(new Set(partitioned).size).toBe(partitioned.length);
+
+    /*
+     * Every enum member lands in exactly one half.
+     */
+    expect(partitioned.slice().sort()).toEqual(allStatuses.slice().sort());
+  });
+
+  test("classifies every enum member without leaving any unclassified", () => {
+    const allStatuses: Array<AutoRemediationSuggestionStatus> = Object.values(
+      AutoRemediationSuggestionStatus,
+    );
+
+    for (const status of allStatuses) {
+      const isTerminal: boolean =
+        AutoRemediationSuggestionStatusHelper.isTerminalStatus(status);
+      const expectedTerminal: boolean = TERMINAL_STATUSES.includes(status);
+      expect(isTerminal).toBe(expectedTerminal);
+    }
+  });
+
+  test("is a pure predicate — repeated calls yield the same result", () => {
+    for (const status of Object.values(AutoRemediationSuggestionStatus)) {
+      const first: boolean =
+        AutoRemediationSuggestionStatusHelper.isTerminalStatus(status);
+      const second: boolean =
+        AutoRemediationSuggestionStatusHelper.isTerminalStatus(status);
+      expect(second).toBe(first);
+    }
+  });
+
+  test("returns exactly a boolean, never a truthy/falsy proxy", () => {
+    const terminalResult: boolean =
+      AutoRemediationSuggestionStatusHelper.isTerminalStatus(
+        AutoRemediationSuggestionStatus.Approved,
+      );
+    const openResult: boolean =
+      AutoRemediationSuggestionStatusHelper.isTerminalStatus(
+        AutoRemediationSuggestionStatus.Planning,
+      );
+    expect(typeof terminalResult).toBe("boolean");
+    expect(typeof openResult).toBe("boolean");
+  });
+
+  test("matches the raw string value of each member (DB/wire representation)", () => {
+    /*
+     * The enum is string-backed, so a persisted row carries the string, not the
+     * TS enum reference. Passing the equivalent raw string must classify the
+     * same way — guarding against a future rename that would strand old rows.
+     */
+    expect(
+      AutoRemediationSuggestionStatusHelper.isTerminalStatus(
+        "Dismissed" as AutoRemediationSuggestionStatus,
+      ),
+    ).toBe(true);
+    expect(
+      AutoRemediationSuggestionStatusHelper.isTerminalStatus(
+        "Suggested" as AutoRemediationSuggestionStatus,
+      ),
+    ).toBe(false);
+  });
+
+  test("treats an unknown status as non-terminal (no false freeze)", () => {
+    /*
+     * Defensive edge: a value outside the enum (legacy or corrupt data) is not
+     * one of the four terminal constants, so the predicate reports false. That
+     * keeps an unrecognized suggestion open/actionable rather than silently
+     * frozen.
+     */
+    expect(
+      AutoRemediationSuggestionStatusHelper.isTerminalStatus(
+        "SomethingElse" as AutoRemediationSuggestionStatus,
+      ),
+    ).toBe(false);
+    expect(
+      AutoRemediationSuggestionStatusHelper.isTerminalStatus(
+        "" as AutoRemediationSuggestionStatus,
+      ),
+    ).toBe(false);
+  });
+});

package/Tests/Types/Call/CallRequest.test.ts

@@ -0,0 +1,189 @@
+import Phone from "../../../Types/Phone";
+import { isHighRiskPhoneNumber } from "../../../Types/Call/CallRequest";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * isHighRiskPhoneNumber(phone) stringifies the Phone and returns true when the
+ * resulting string starts with any of a fixed set of high-risk country dialing
+ * codes. The matching is a plain String.prototype.startsWith over the raw
+ * value, so behavior hinges on: the exact leading characters (including the
+ * "+"), the ordering-independent "some" scan, and the boundary between a real
+ * code and a number that merely shares leading digits with one.
+ *
+ * These tests exercise the real branches: every high-risk code (true path),
+ * ordinary countries (false path), near-miss prefixes that share leading digits
+ * but are not a code, the required leading "+", formatting/length boundaries,
+ * and copy-constructed Phone objects.
+ */
+
+/*
+ * The exact high-risk set encoded in CallRequest.ts. Kept as a local literal so
+ * the test asserts against a known expectation rather than re-importing the
+ * private constant.
+ */
+const HIGH_RISK_DIALING_CODES: Array<string> = [
+  "+92",
+  "+27",
+  "+213",
+  "+371",
+  "+370",
+  "+372",
+  "+252",
+  "+232",
+  "+231",
+  "+53",
+  "+960",
+  "+992",
+  "+880",
+  "+62",
+  "+84",
+  "+95",
+];
+
+type MakeValidNumberFunction = (dialingCode: string) => string;
+
+/*
+ * Build a phone string that starts with the given dialing code and satisfies
+ * Phone's constructor regex (3 digits, 3 digits, then 4-7 digits => 10-13 total
+ * digits). Padding with zeros to 12 total digits keeps every generated number
+ * inside the valid range regardless of whether the code has 2 or 3 digits.
+ */
+const makeValidNumber: MakeValidNumberFunction = (
+  dialingCode: string,
+): string => {
+  const digits: string = dialingCode.replace("+", "");
+  const padding: string = "0000000000000".substring(0, 12 - digits.length);
+  return "+" + digits + padding;
+};
+
+describe("isHighRiskPhoneNumber flags every high-risk dialing code", () => {
+  test.each(HIGH_RISK_DIALING_CODES)(
+    "flags a number starting with %s",
+    (dialingCode: string) => {
+      const phone: Phone = new Phone(makeValidNumber(dialingCode));
+      expect(isHighRiskPhoneNumber(phone)).toBe(true);
+    },
+  );
+
+  test("flags Tajikistan (+992) on its own three-digit code, not via +92", () => {
+    /*
+     * +992 does not start with +92, so it can only be flagged by its own
+     * three-digit entry. This guards against a regression where only the
+     * shorter code were present.
+     */
+    const phone: Phone = new Phone(makeValidNumber("+992"));
+    expect(phone.toString().startsWith("+92")).toBe(false);
+    expect(isHighRiskPhoneNumber(phone)).toBe(true);
+  });
+});
+
+describe("isHighRiskPhoneNumber does not flag ordinary / low-risk countries", () => {
+  const lowRiskNumbers: Array<string> = [
+    "+15551234567", // United States / Canada (+1)
+    "+442071234567", // United Kingdom (+44)
+    "+491234567890", // Germany (+49)
+    "+611234567890", // Australia (+61)
+    "+331234567890", // France (+33)
+    "+811234567890", // Japan (+81)
+    "+861234567890", // China (+86)
+    "+551234567890", // Brazil (+55)
+    "+521234567890", // Mexico (+52) sits right next to Cuba (+53)
+    "+919876543210", // India (+91) sits right next to Pakistan (+92)
+  ];
+
+  test.each(lowRiskNumbers)("does not flag %s", (phoneNumber: string) => {
+    const phone: Phone = new Phone(phoneNumber);
+    expect(isHighRiskPhoneNumber(phone)).toBe(false);
+  });
+});
+
+describe("near-miss prefixes that only share leading digits are not flagged", () => {
+  /*
+   * Each entry starts with the same first digits as a real high-risk code but
+   * diverges before the full code, so startsWith must return false. This is the
+   * key discriminating branch: matching is prefix-exact, not "close enough".
+   */
+  const nearMisses: Array<[string, string]> = [
+    ["+254123456789", "Kenya (+254) vs Somalia (+252)"],
+    ["+994123456789", "Azerbaijan (+994) vs Tajikistan (+992)"],
+    ["+886123456789", "Taiwan (+886) vs Bangladesh (+880)"],
+    [
+      "+373123456789",
+      "Moldova (+373) vs Latvia/Lithuania/Estonia (+371/+370/+372)",
+    ],
+    ["+919876543210", "India (+91) vs Pakistan (+92)"],
+    ["+521234567890", "Mexico (+52) vs Cuba (+53)"],
+  ];
+
+  test.each(nearMisses)("does not flag %s", (phoneNumber: string) => {
+    const phone: Phone = new Phone(phoneNumber);
+    expect(isHighRiskPhoneNumber(phone)).toBe(false);
+  });
+});
+
+describe("the leading + is part of the match", () => {
+  test("a high-risk number without the leading + is not flagged", () => {
+    /*
+     * The stored value is exactly what the caller passed. Without the "+", the
+     * string is "920000000000", which does not start with "+92".
+     */
+    const phone: Phone = new Phone("920000000000");
+    expect(phone.toString().startsWith("+")).toBe(false);
+    expect(isHighRiskPhoneNumber(phone)).toBe(false);
+  });
+
+  test("the same digits with the leading + are flagged", () => {
+    const phone: Phone = new Phone("+920000000000");
+    expect(isHighRiskPhoneNumber(phone)).toBe(true);
+  });
+});
+
+describe("formatting and length boundaries", () => {
+  test("flags a high-risk number written with separators after the code", () => {
+    /*
+     * "+232-123-4567" is a valid Phone (3 digits, sep, 3 digits, sep, 4 digits)
+     * whose string still starts with the Sierra Leone code "+232".
+     */
+    const phone: Phone = new Phone("+232-123-4567");
+    expect(isHighRiskPhoneNumber(phone)).toBe(true);
+  });
+
+  test("flags the shortest valid high-risk number (10 digits)", () => {
+    const phone: Phone = new Phone("+9200000000");
+    expect(isHighRiskPhoneNumber(phone)).toBe(true);
+  });
+
+  test("flags the longest valid high-risk number (13 digits)", () => {
+    const phone: Phone = new Phone("+9200000000000");
+    expect(isHighRiskPhoneNumber(phone)).toBe(true);
+  });
+});
+
+describe("Phone construction variants are evaluated identically", () => {
+  test("a Phone copy-constructed from another Phone is still flagged", () => {
+    const original: Phone = new Phone("+920000000000");
+    const copy: Phone = new Phone(original);
+    expect(copy.toString()).toEqual(original.toString());
+    expect(isHighRiskPhoneNumber(copy)).toBe(true);
+  });
+
+  test("mutating a Phone to a high-risk value changes the result", () => {
+    const phone: Phone = new Phone("+15551234567");
+    expect(isHighRiskPhoneNumber(phone)).toBe(false);
+    phone.phone = "+840000000000";
+    expect(isHighRiskPhoneNumber(phone)).toBe(true);
+  });
+});
+
+describe("return value contract", () => {
+  test("always returns a strict boolean", () => {
+    const flagged: boolean = isHighRiskPhoneNumber(new Phone("+920000000000"));
+    const notFlagged: boolean = isHighRiskPhoneNumber(
+      new Phone("+15551234567"),
+    );
+    expect(typeof flagged).toBe("boolean");
+    expect(typeof notFlagged).toBe("boolean");
+    expect(flagged).toBe(true);
+    expect(notFlagged).toBe(false);
+  });
+});