@oneuptime/common 12.0.13 → 12.0.14

package/Tests/Types/Service/ServiceLanguage.test.ts

@@ -0,0 +1,255 @@
+import {
+  SERVICE_LANGUAGE_DISPLAY_NAMES,
+  ServiceLanguage,
+  detectServiceLanguage,
+} from "../../../Types/Service/ServiceLanguage";
+import TechStack from "../../../Types/Service/TechStack";
+
+/*
+ * Which runtime a service is written in, decided from three sources of
+ * evidence of decreasing trustworthiness.
+ *
+ * This used to only pick which charts to draw on the service overview, where
+ * a wrong answer is a chart with no data in it. It now also picks which
+ * monitors OneUptime recommends, where a wrong answer is a monitor that
+ * queries a metric the service never emits and therefore never fires — a
+ * silent gap that reads as coverage. Every case below is about the difference
+ * between "we know" and "we are guessing".
+ */
+
+const ALL_LANGUAGES: Array<ServiceLanguage> = Object.keys(
+  SERVICE_LANGUAGE_DISPLAY_NAMES,
+) as Array<ServiceLanguage>;
+
+describe("detectServiceLanguage", () => {
+  describe("precedence between the three sources", () => {
+    /*
+     * The order is not arbitrary. `telemetry.sdk.language` is stamped by the
+     * SDK inside the process, so it describes what the process actually runs
+     * on. `process.runtime.name` is the same information one hop later.
+     * The tech stack is a human's answer typed into a form, which can be
+     * months out of date. Each test below sets up a deliberate disagreement
+     * so the winner is unambiguous.
+     */
+    it("prefers the SDK language over the runtime name", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "go",
+          runtimeName: "OpenJDK Runtime Environment",
+        }),
+      ).toBe("go");
+    });
+
+    it("prefers the SDK language over the tech stack", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "python",
+          techStack: [TechStack.Java],
+        }),
+      ).toBe("python");
+    });
+
+    it("prefers the runtime name over the tech stack", () => {
+      expect(
+        detectServiceLanguage({
+          runtimeName: "node",
+          techStack: [TechStack.Java],
+        }),
+      ).toBe("nodejs");
+    });
+
+    it("falls through to the tech stack when telemetry says nothing", () => {
+      expect(
+        detectServiceLanguage({
+          techStack: [TechStack.Rust],
+        }),
+      ).toBe("rust");
+    });
+  });
+
+  describe("the SDK language attribute", () => {
+    it.each(ALL_LANGUAGES)("recognises %s", (language: ServiceLanguage) => {
+      expect(detectServiceLanguage({ telemetrySdkLanguage: language })).toBe(
+        language,
+      );
+    });
+
+    it("is matched case-insensitively and ignores surrounding whitespace", () => {
+      expect(
+        detectServiceLanguage({ telemetrySdkLanguage: "  DotNet  " }),
+      ).toBe("dotnet");
+    });
+
+    /*
+     * The important negative case. An unrecognised value must NOT be returned
+     * verbatim — it would be a string that looks like a `ServiceLanguage` to
+     * every consumer and matches no template set, so the recommendations page
+     * would show nothing at all rather than the language-agnostic set.
+     */
+    it("does not pass an unrecognised SDK language through", () => {
+      expect(
+        detectServiceLanguage({ telemetrySdkLanguage: "cobol" }),
+      ).toBeNull();
+    });
+
+    it("falls through to the other sources when the SDK language is unknown", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "cobol",
+          techStack: [TechStack.Go],
+        }),
+      ).toBe("go");
+    });
+  });
+
+  describe("the runtime name markers", () => {
+    it.each([
+      ["OpenJDK 64-Bit Server VM", "java"],
+      ["GraalVM CE", "java"],
+      ["Java HotSpot(TM) 64-Bit Server VM", "java"],
+      [".NET 9.0.0", "dotnet"],
+      ["dotnet", "dotnet"],
+      ["node", "nodejs"],
+      ["Deno", "nodejs"],
+      ["bun", "nodejs"],
+      ["CPython", "python"],
+      ["PyPy", "python"],
+      ["BEAM", "erlang"],
+      ["Erlang/OTP 26", "erlang"],
+      ["ruby", "ruby"],
+      ["PHP 8.3", "php"],
+      ["rustc", "rust"],
+      ["swift", "swift"],
+      ["go", "go"],
+    ])(
+      "maps runtime name %s to %s",
+      (runtimeName: string, expected: string) => {
+        expect(detectServiceLanguage({ runtimeName: runtimeName })).toBe(
+          expected,
+        );
+      },
+    );
+
+    /*
+     * `go` is a two-letter substring, so it appears inside plenty of words —
+     * "GraalVM" does not contain it, but the ordering still matters and this
+     * pins it: the JVM markers are checked first, so a runtime string that
+     * contains both loses to the more specific one.
+     */
+    it("checks specific markers before the two-letter go marker", () => {
+      expect(
+        detectServiceLanguage({ runtimeName: "GraalVM for Go interop" }),
+      ).toBe("java");
+    });
+
+    it("returns null for a runtime name it does not recognise", () => {
+      expect(detectServiceLanguage({ runtimeName: "SomeVM 1.0" })).toBeNull();
+    });
+  });
+
+  describe("the tech stack fallback", () => {
+    it("maps Kotlin to java, because the runtime is what matters", () => {
+      expect(detectServiceLanguage({ techStack: [TechStack.Kotlin] })).toBe(
+        "java",
+      );
+    });
+
+    it("maps C# to dotnet", () => {
+      expect(detectServiceLanguage({ techStack: [TechStack.CSharp] })).toBe(
+        "dotnet",
+      );
+    });
+
+    it.each([TechStack.TypeScript, TechStack.JavaScript, TechStack.NodeJS])(
+      "maps %s to nodejs",
+      (techStack: TechStack) => {
+        expect(detectServiceLanguage({ techStack: [techStack] })).toBe(
+          "nodejs",
+        );
+      },
+    );
+
+    it("maps React to webjs rather than to nodejs", () => {
+      expect(detectServiceLanguage({ techStack: [TechStack.React] })).toBe(
+        "webjs",
+      );
+    });
+
+    it("takes the first entry that maps to a runtime", () => {
+      expect(
+        detectServiceLanguage({
+          techStack: [TechStack.Shell, TechStack.Markdown, TechStack.Go],
+        }),
+      ).toBe("go");
+    });
+
+    it.each([TechStack.Shell, TechStack.Markdown, TechStack.Other])(
+      "does not invent a runtime for %s",
+      (techStack: TechStack) => {
+        expect(detectServiceLanguage({ techStack: [techStack] })).toBeNull();
+      },
+    );
+  });
+
+  describe("when nothing identifies the runtime", () => {
+    /*
+     * Null, never a default. A default would hand every unidentified service
+     * one language's recommendations — monitors on metrics it does not emit,
+     * presented as if OneUptime had established what it runs on.
+     */
+    it("returns null for no input at all", () => {
+      expect(detectServiceLanguage({})).toBeNull();
+    });
+
+    it("returns null for empty strings and an empty tech stack", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "",
+          runtimeName: "",
+          techStack: [],
+        }),
+      ).toBeNull();
+    });
+
+    it("returns null for whitespace-only telemetry values", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "   ",
+          runtimeName: "  ",
+        }),
+      ).toBeNull();
+    });
+
+    it("returns null for explicitly undefined fields", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: undefined,
+          runtimeName: undefined,
+          techStack: undefined,
+        }),
+      ).toBeNull();
+    });
+  });
+});
+
+describe("SERVICE_LANGUAGE_DISPLAY_NAMES", () => {
+  it("names every language, non-blank", () => {
+    expect(ALL_LANGUAGES.length).toBeGreaterThan(0);
+
+    for (const language of ALL_LANGUAGES) {
+      expect(
+        SERVICE_LANGUAGE_DISPLAY_NAMES[language].trim().length,
+      ).toBeGreaterThan(0);
+    }
+  });
+
+  it("gives each language a distinct display name", () => {
+    const names: Array<string> = ALL_LANGUAGES.map(
+      (language: ServiceLanguage) => {
+        return SERVICE_LANGUAGE_DISPLAY_NAMES[language];
+      },
+    );
+
+    expect(new Set<string>(names).size).toBe(names.length);
+  });
+});

package/Tests/Types/TextRandomGeneration.test.ts

@@ -0,0 +1,211 @@
+import Text from "../../Types/Text";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * GHSA-5cr8-vph4-3hrf, CWE-330.
+ *
+ * Text.generateRandomNumber is what mints notification-channel verification
+ * codes. It used to draw from the literal string "12134567890" using
+ * Math.random, which is wrong twice over: the alphabet has "1" in it twice so
+ * the digits are not equally likely, and Math.random is a non-cryptographic
+ * PRNG whose state is recoverable from its own output.
+ *
+ * Neither property can be observed by looking at one value, which is why they
+ * survived. The tests below observe them the only ways available: by counting
+ * a large sample for bias, and by watching which source the generator actually
+ * pulls from.
+ */
+describe("Text random generation", () => {
+  describe("generateRandomNumber", () => {
+    it("emits only digits, at the requested length", () => {
+      for (let length: number = 1; length <= 12; length++) {
+        const value: string = Text.generateRandomNumber(length);
+
+        expect(value).toHaveLength(length);
+        expect(value).toMatch(/^[0-9]+$/);
+      }
+    });
+
+    it("defaults to ten characters", () => {
+      expect(Text.generateRandomNumber()).toHaveLength(10);
+    });
+
+    /*
+     * The direct regression. With the old alphabet the digit "1" appeared
+     * twice in an eleven-character string, so it came up 2/11 of the time
+     * against 1/11 for every other digit — and "8" appeared once, like the
+     * rest, only because the typo happened to leave it in.
+     *
+     * 60,000 digits puts the expected count per digit at 6,000 with a
+     * standard deviation of about 73. The old generator produced ~10,909 ones
+     * and ~5,454 of everything else, so the bound below is enormously loose
+     * for a fair generator and enormously tight for the broken one.
+     */
+    it("draws every digit with equal probability", () => {
+      const sampleSize: number = 10000;
+      const digitsPerSample: number = 6;
+      const counts: Record<string, number> = {};
+
+      for (let i: number = 0; i < sampleSize; i++) {
+        for (const digit of Text.generateRandomNumber(digitsPerSample)) {
+          counts[digit] = (counts[digit] || 0) + 1;
+        }
+      }
+
+      const totalDigits: number = sampleSize * digitsPerSample;
+      const expectedPerDigit: number = totalDigits / 10;
+
+      /*
+       * Every digit must actually appear — "8" was reachable before, but a
+       * future typo in the alphabet would show up here.
+       */
+      expect(Object.keys(counts).sort()).toEqual([
+        "0",
+        "1",
+        "2",
+        "3",
+        "4",
+        "5",
+        "6",
+        "7",
+        "8",
+        "9",
+      ]);
+
+      for (const digit of Object.keys(counts)) {
+        const count: number = counts[digit] as number;
+
+        /*
+         * Six sigma either way: a fair generator fails this about once in
+         * 500 million runs, the old one fails it every time.
+         */
+        expect(count).toBeGreaterThan(expectedPerDigit * 0.9);
+        expect(count).toBeLessThan(expectedPerDigit * 1.1);
+      }
+    });
+
+    /*
+     * Leading zeros are part of the code space. Dropping them — by going
+     * through a number, say — would quietly remove a tenth of it.
+     */
+    it("can produce codes with leading zeros", () => {
+      let sawLeadingZero: boolean = false;
+
+      for (let i: number = 0; i < 500; i++) {
+        if (Text.generateRandomNumber(6).startsWith("0")) {
+          sawLeadingZero = true;
+          break;
+        }
+      }
+
+      expect(sawLeadingZero).toBe(true);
+    });
+
+    /*
+     * The other half of CWE-330. Math.random is seeded per process and its
+     * internal state can be recovered from a handful of outputs, after which
+     * every future value is known exactly — no guessing required. Asserting
+     * on the SOURCE is the only way to pin this: any specific output is a
+     * legal output of either generator.
+     */
+    it("does not fall back to Math.random when a CSPRNG is available", () => {
+      const mathRandomSpy: jest.SpyInstance = jest.spyOn(Math, "random");
+
+      try {
+        for (let i: number = 0; i < 100; i++) {
+          Text.generateRandomNumber(6);
+        }
+
+        expect(mathRandomSpy).not.toHaveBeenCalled();
+      } finally {
+        mathRandomSpy.mockRestore();
+      }
+    });
+
+    it("takes its bytes from crypto.getRandomValues", () => {
+      const getRandomValuesSpy: jest.SpyInstance = jest.spyOn(
+        globalThis.crypto,
+        "getRandomValues",
+      );
+
+      try {
+        Text.generateRandomNumber(6);
+
+        expect(getRandomValuesSpy).toHaveBeenCalled();
+      } finally {
+        getRandomValuesSpy.mockRestore();
+      }
+    });
+
+    it("produces a different value practically every time", () => {
+      const seen: Set<string> = new Set<string>();
+
+      for (let i: number = 0; i < 1000; i++) {
+        seen.add(Text.generateRandomNumber(10));
+      }
+
+      /*
+       * Ten digits, a thousand draws: collisions are vanishingly unlikely,
+       * and a stuck generator would collapse this to 1.
+       */
+      expect(seen.size).toBe(1000);
+    });
+  });
+
+  describe("generateRandomText", () => {
+    it("emits only letters, at the requested length", () => {
+      for (let length: number = 1; length <= 40; length += 7) {
+        const value: string = Text.generateRandomText(length);
+
+        expect(value).toHaveLength(length);
+        expect(value).toMatch(/^[A-Za-z]+$/);
+      }
+    });
+
+    it("defaults to ten characters", () => {
+      expect(Text.generateRandomText()).toHaveLength(10);
+    });
+
+    it("does not fall back to Math.random when a CSPRNG is available", () => {
+      const mathRandomSpy: jest.SpyInstance = jest.spyOn(Math, "random");
+
+      try {
+        for (let i: number = 0; i < 100; i++) {
+          Text.generateRandomText(20);
+        }
+
+        expect(mathRandomSpy).not.toHaveBeenCalled();
+      } finally {
+        mathRandomSpy.mockRestore();
+      }
+    });
+
+    /*
+     * Both alphabets have 52 characters, which does NOT divide 256 — so
+     * `byte % 52` would be biased towards the first 48 letters. The rejection
+     * sampling is what removes that, and this is the test that would notice
+     * if somebody "simplified" it away.
+     */
+    it("draws every letter with roughly equal probability", () => {
+      const counts: Record<string, number> = {};
+      const totalCharacters: number = 52 * 2000;
+
+      for (let i: number = 0; i < 2000; i++) {
+        for (const character of Text.generateRandomText(52)) {
+          counts[character] = (counts[character] || 0) + 1;
+        }
+      }
+
+      expect(Object.keys(counts)).toHaveLength(52);
+
+      const expectedPerCharacter: number = totalCharacters / 52;
+
+      for (const character of Object.keys(counts)) {
+        const count: number = counts[character] as number;
+
+        expect(count).toBeGreaterThan(expectedPerCharacter * 0.85);
+        expect(count).toBeLessThan(expectedPerCharacter * 1.15);
+      }
+    });
+  });
+});

package/Tests/UI/Components/Button.test.tsx

@@ -9,7 +9,7 @@ import "@testing-library/jest-dom";
 import { fireEvent, render, screen } from "@testing-library/react";
 import IconProp from "../../../Types/Icon/IconProp";
 import React from "react";
-import { describe, expect, jest } from "@jest/globals";
+import { afterEach, describe, expect, jest } from "@jest/globals";
 
 describe("Button", () => {
   test("it should render correctly with title and icon", () => {
@@ -479,3 +479,177 @@ describe("Button disabled behaviour", () => {
     expect(handleClick).not.toBeCalled();
   });
 });
+
+describe("Button motion", () => {
+  /*
+   * Hover/focus colour changes ease in instead of snapping. The classes are
+   * appended once at the shared point every variant funnels through, so every
+   * style must carry them.
+   */
+  test.each(ALL_BUTTON_STYLES)(
+    "%s carries the shared colour-transition classes",
+    (_name: string, buttonStyle: ButtonStyleType) => {
+      expect(renderButton({ buttonStyle })).toHaveClass(
+        "transition-colors",
+        "duration-150",
+        "ease-out",
+      );
+    },
+  );
+});
+
+describe("Button link focus rings", () => {
+  /*
+   * LINK and SECONDARY_LINK used to have no ring at all, leaving keyboard
+   * users with no focus indicator on text links. focus-visible (rather than
+   * focus:) so mouse clicks do not flash a ring.
+   */
+  const LINK_STYLES: Array<[string, ButtonStyleType]> = [
+    ["LINK", ButtonStyleType.LINK],
+    ["SECONDARY_LINK", ButtonStyleType.SECONDARY_LINK],
+  ];
+
+  test.each(LINK_STYLES)(
+    "%s carries a focus-visible ring",
+    (_name: string, buttonStyle: ButtonStyleType) => {
+      expect(renderButton({ buttonStyle })).toHaveClass(
+        "focus:outline-none",
+        "focus-visible:ring-2",
+        "focus-visible:ring-indigo-500",
+        "focus-visible:ring-offset-2",
+      );
+    },
+  );
+});
+
+interface ListenerCall {
+  handler: unknown;
+}
+
+type FindKeydownCallsFunction = (
+  spy: ReturnType<typeof jest.spyOn>,
+) => Array<ListenerCall>;
+
+const findKeydownCalls: FindKeydownCallsFunction = (
+  spy: ReturnType<typeof jest.spyOn>,
+): Array<ListenerCall> => {
+  const calls: Array<Array<unknown>> = spy.mock.calls as unknown as Array<
+    Array<unknown>
+  >;
+
+  return calls
+    .filter((call: Array<unknown>): boolean => {
+      return call[0] === "keydown";
+    })
+    .map((call: Array<unknown>): ListenerCall => {
+      return { handler: call[1] };
+    });
+};
+
+describe("Button shortcut listener lifecycle", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * The regression this suite exists for: the shortcut effect had no
+   * dependency array and its cleanup passed a NEW arrow function to
+   * removeEventListener, which therefore never matched the one that was
+   * added — every render leaked a live window keydown listener.
+   */
+  test("unmount removes the same keydown handler that was added", () => {
+    const addSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      window,
+      "addEventListener",
+    );
+    const removeSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      window,
+      "removeEventListener",
+    );
+
+    const { unmount } = render(
+      <Button dataTestId="test-id" shortcutKey={ShortcutKey.Settings} />,
+    );
+
+    const adds: Array<ListenerCall> = findKeydownCalls(addSpy);
+
+    expect(adds).toHaveLength(1);
+    expect(findKeydownCalls(removeSpy)).toHaveLength(0);
+
+    unmount();
+
+    const removes: Array<ListenerCall> = findKeydownCalls(removeSpy);
+
+    expect(removes).toHaveLength(1);
+    /*
+     * removeEventListener only detaches when the handler identity matches the
+     * add; counting calls alone would let the old always-leaking cleanup pass.
+     */
+    expect(removes[0]?.handler).toBe(adds[0]?.handler);
+  });
+
+  test("re-rendering with the same props does not stack extra listeners", () => {
+    const addSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      window,
+      "addEventListener",
+    );
+
+    const { rerender } = render(
+      <Button dataTestId="test-id" shortcutKey={ShortcutKey.Settings} />,
+    );
+
+    rerender(
+      <Button dataTestId="test-id" shortcutKey={ShortcutKey.Settings} />,
+    );
+    rerender(
+      <Button dataTestId="test-id" shortcutKey={ShortcutKey.Settings} />,
+    );
+
+    expect(findKeydownCalls(addSpy)).toHaveLength(1);
+  });
+
+  test("a button without a shortcut registers no keydown listener", () => {
+    const addSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      window,
+      "addEventListener",
+    );
+
+    render(<Button dataTestId="test-id" />);
+
+    expect(findKeydownCalls(addSpy)).toHaveLength(0);
+  });
+
+  test("the shortcut key pressed on the page body fires onClick", () => {
+    const handleClick: () => void = jest.fn();
+
+    render(
+      <Button
+        dataTestId="test-id"
+        shortcutKey={ShortcutKey.Settings}
+        onClick={handleClick}
+      />,
+    );
+
+    fireEvent.keyDown(document.body, { key: "s" });
+
+    expect(handleClick).toHaveBeenCalledTimes(1);
+  });
+
+  test("the shortcut stops firing after unmount", () => {
+    const handleClick: () => void = jest.fn();
+
+    const { unmount } = render(
+      <Button
+        dataTestId="test-id"
+        shortcutKey={ShortcutKey.Settings}
+        onClick={handleClick}
+      />,
+    );
+
+    unmount();
+
+    fireEvent.keyDown(document.body, { key: "s" });
+
+    expect(handleClick).not.toBeCalled();
+  });
+});