@oneuptime/common 12.0.13 → 12.0.15

package/Tests/Server/Utils/Monitor/SeriesResourceLinker.test.ts

@@ -36,8 +36,9 @@ import SeriesResourceLinker, {
 } from "../../../../Server/Utils/Monitor/SeriesResourceLinker";
 import Includes from "../../../../Types/BaseDatabase/Includes";
 import { JSONObject } from "../../../../Types/JSON";
+import MonitorType from "../../../../Types/Monitor/MonitorType";
 import ObjectID from "../../../../Types/ObjectID";
-import { MonitorClusterContext } from "../../../../Server/Utils/Monitor/MonitorClusterContext";
+
 import {
   afterEach,
   beforeEach,
@@ -176,8 +177,13 @@ function includesValues(value: unknown): Array<string> {
   });
 }
 
-function emptyClusterContext(): MonitorClusterContext {
+function emptyResourceContext(): SeriesResolvedResourceIds {
   return {
+    hostIds: [],
+    dockerHostIds: [],
+    podmanHostIds: [],
+    kubernetesClusterIds: [],
+    serviceIds: [],
     proxmoxClusterIds: [],
     cephClusterIds: [],
     dockerSwarmClusterIds: [],
@@ -356,6 +362,73 @@ describe("SeriesResourceLinker.linkSeriesResourcesToModel", () => {
     },
   );
 
+  test.each([[MonitorType.Docker], [MonitorType.Podman]])(
+    "a %s monitor's host.name label links no Host",
+    async (monitorType: MonitorType) => {
+      /*
+       * The container agents stamp the box their containers run on under
+       * the generic `resource.host.name`, which the label key map hands
+       * to Host. On a Docker/Podman monitor that value names a
+       * DockerHost / PodmanHost row, so honouring the map would attach an
+       * unrelated Host and surface the event on that host's Activity tab.
+       * The step-config path (MonitorStepResourceIdentity) links the
+       * right model instead.
+       */
+      rowsByRelation.set("hosts", [{ _id: "host-1" }]);
+
+      const alert: Alert = new Alert();
+
+      await SeriesResourceLinker.linkSeriesResourcesToModel({
+        model: alert,
+        seriesLabels: { "host.name": "docker-prod-01" },
+        projectId: PROJECT_ID,
+        monitorType: monitorType,
+      });
+
+      expect(alert.hosts).toBeUndefined();
+      expect(HostService.findBy).not.toHaveBeenCalled();
+    },
+  );
+
+  test("a host.name label still links a Host for every other monitor type", async () => {
+    // The suppression must be scoped to the two container types only.
+    rowsByRelation.set("hosts", [{ _id: "host-1" }]);
+
+    const alert: Alert = new Alert();
+
+    await SeriesResourceLinker.linkSeriesResourcesToModel({
+      model: alert,
+      seriesLabels: { "host.name": "prod-01" },
+      projectId: PROJECT_ID,
+      monitorType: MonitorType.Host,
+    });
+
+    expect(idsOn(alert, "hosts")).toEqual(["host-1"]);
+  });
+
+  test("a Docker monitor still links the docker host its labels name", async () => {
+    /*
+     * Suppression must drop ONLY the host refs — the DockerHost the
+     * series actually identifies has to survive.
+     */
+    rowsByRelation.set("dockerHosts", [{ _id: "docker-1" }]);
+
+    const alert: Alert = new Alert();
+
+    await SeriesResourceLinker.linkSeriesResourcesToModel({
+      model: alert,
+      seriesLabels: {
+        "host.name": "docker-prod-01",
+        "oneuptime.docker.host.name": "docker-prod-01",
+      },
+      projectId: PROJECT_ID,
+      monitorType: MonitorType.Docker,
+    });
+
+    expect(alert.hosts).toBeUndefined();
+    expect(idsOn(alert, "dockerHosts")).toEqual(["docker-1"]);
+  });
+
   test("a bare host name never resolves a docker or podman host", async () => {
     /*
      * Docker/Podman hosts are deliberately addressed only by their own
@@ -596,13 +669,14 @@ describe("SeriesResourceLinker.resolveResourcesFromSeriesLabels", () => {
   });
 });
 
-describe("SeriesResourceLinker.attachClusterContext", () => {
-  test("attaches the monitor-step clusters", () => {
+describe("SeriesResourceLinker.attachResolvedResources", () => {
+  test("attaches the monitor-step resources", () => {
     const alert: Alert = new Alert();
 
-    SeriesResourceLinker.attachClusterContext({
+    SeriesResourceLinker.attachResolvedResources({
       model: alert,
-      clusterContext: {
+      resolved: {
+        ...emptyResourceContext(),
         proxmoxClusterIds: ["pve-1"],
         cephClusterIds: ["ceph-1"],
         dockerSwarmClusterIds: ["swarm-1"],
@@ -633,10 +707,10 @@ describe("SeriesResourceLinker.attachClusterContext", () => {
       projectId: PROJECT_ID,
     });
 
-    SeriesResourceLinker.attachClusterContext({
+    SeriesResourceLinker.attachResolvedResources({
       model: alert,
-      clusterContext: {
-        ...emptyClusterContext(),
+      resolved: {
+        ...emptyResourceContext(),
         proxmoxClusterIds: ["pve-from-step-config"],
       },
     });
@@ -658,10 +732,10 @@ describe("SeriesResourceLinker.attachClusterContext", () => {
       projectId: PROJECT_ID,
     });
 
-    SeriesResourceLinker.attachClusterContext({
+    SeriesResourceLinker.attachResolvedResources({
       model: alert,
-      clusterContext: {
-        ...emptyClusterContext(),
+      resolved: {
+        ...emptyResourceContext(),
         cephClusterIds: ["ceph-1"],
       },
     });
@@ -669,12 +743,12 @@ describe("SeriesResourceLinker.attachClusterContext", () => {
     expect(idsOn(alert, "cephClusters")).toEqual(["ceph-1"]);
   });
 
-  test("leaves every relation untouched when the monitor has no clusters", () => {
+  test("leaves every relation untouched when the monitor names no resource", () => {
     const alert: Alert = new Alert();
 
-    SeriesResourceLinker.attachClusterContext({
+    SeriesResourceLinker.attachResolvedResources({
       model: alert,
-      clusterContext: emptyClusterContext(),
+      resolved: emptyResourceContext(),
     });
 
     expect(alert.proxmoxClusters).toBeUndefined();
@@ -686,10 +760,10 @@ describe("SeriesResourceLinker.attachClusterContext", () => {
   test("attaches to an incident the same way", () => {
     const incident: Incident = new Incident();
 
-    SeriesResourceLinker.attachClusterContext({
+    SeriesResourceLinker.attachResolvedResources({
       model: incident,
-      clusterContext: {
-        ...emptyClusterContext(),
+      resolved: {
+        ...emptyResourceContext(),
         dockerSwarmClusterIds: ["swarm-1"],
       },
     });

package/Tests/Server/Utils/PushNotificationUtilCreators.test.ts

@@ -0,0 +1,267 @@
+import PushNotificationUtil from "../../../Server/Utils/PushNotificationUtil";
+import PushNotificationMessage from "../../../Types/PushNotification/PushNotificationMessage";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Behavioural coverage for the PushNotificationUtil creators that the sibling
+ * PushNotificationUtil.test.ts does not touch. Each creator is a pure builder,
+ * but each carries real display logic a responder sees on a locked screen:
+ * which identifier the title shows (a prefixed number, a bare #number, or just
+ * the title), whether a note reads as Private or Public, and whether a click
+ * target is wired through. A regression in any of these is a page that opens
+ * the wrong thing or leaks the wrong label, so they are pinned here.
+ */
+
+describe("PushNotificationUtil untested creators", () => {
+  describe("defaults are applied to every creator", () => {
+    test("icon and badge are stamped on by applyDefaults", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyAddedNotification({
+          policyName: "Primary",
+        });
+
+      expect(message.icon).toBe(PushNotificationUtil.DEFAULT_ICON);
+      expect(message.badge).toBe(PushNotificationUtil.DEFAULT_BADGE);
+    });
+  });
+
+  describe("createAlertCreatedNotification - display number precedence", () => {
+    test("a prefixed number wins over a bare number in title and body", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertCreatedNotification({
+          alertTitle: "Disk full",
+          projectName: "Acme",
+          alertViewLink: "https://x/alert/1",
+          alertNumber: 12,
+          alertNumberWithPrefix: "ALERT-12",
+          alertId: "a1",
+          projectId: "p1",
+        });
+
+      expect(message.title).toBe("New Alert ALERT-12: Disk full");
+      expect(message.body).toContain("ALERT-12 (Disk full)");
+      expect(message.body).toContain("in Acme");
+    });
+
+    test("a bare number is rendered as #number when no prefix is given", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertCreatedNotification({
+          alertTitle: "Disk full",
+          projectName: "Acme",
+          alertViewLink: "https://x/alert/1",
+          alertNumber: 12,
+        });
+
+      expect(message.title).toBe("New Alert #12: Disk full");
+      expect(message.body).toContain("#12 (Disk full)");
+    });
+
+    test("with neither number the identifier is just the title", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertCreatedNotification({
+          alertTitle: "Disk full",
+          projectName: "Acme",
+          alertViewLink: "https://x/alert/1",
+        });
+
+      expect(message.title).toBe("New Alert: Disk full");
+      // No leading space and no parenthesised number when there is no number.
+      expect(message.body).toContain("created: Disk full in Acme");
+      expect(message.title).not.toContain("  ");
+    });
+
+    test("wires clickAction, url and requireInteraction, and carries the payload", () => {
+      const link: string = "https://dashboard/alert/42";
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertCreatedNotification({
+          alertTitle: "Disk full",
+          projectName: "Acme",
+          alertViewLink: link,
+          alertId: "a42",
+          projectId: "p9",
+        });
+
+      expect(message.clickAction).toBe(link);
+      expect(message.url).toBe(link);
+      expect(message.requireInteraction).toBe(true);
+      expect(message.tag).toBe("alert-created");
+      expect(message.data).toMatchObject({
+        type: "alert-created",
+        entityType: "alert",
+        entityId: "a42",
+        projectId: "p9",
+        url: link,
+      });
+    });
+  });
+
+  describe("createAlertEpisodeCreatedNotification", () => {
+    test("uses the alert-episode tag, title and payload type", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createAlertEpisodeCreatedNotification({
+          alertEpisodeTitle: "Cascade",
+          projectName: "Acme",
+          alertEpisodeViewLink: "https://x/ep/1",
+          episodeNumberWithPrefix: "EP-3",
+        });
+
+      expect(message.title).toBe("New Alert Episode EP-3: Cascade");
+      expect(message.tag).toBe("alert-episode-created");
+      expect(message.data).toMatchObject({
+        type: "alert-episode-created",
+        entityType: "alert-episode",
+      });
+    });
+  });
+
+  describe("createIncidentEpisodeCreatedNotification", () => {
+    test("uses the incident-episode tag and title", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentEpisodeCreatedNotification({
+          incidentEpisodeTitle: "Cascade",
+          projectName: "Acme",
+          incidentEpisodeViewLink: "https://x/ep/1",
+          episodeNumber: 7,
+        });
+
+      expect(message.title).toBe("New Incident Episode #7: Cascade");
+      expect(message.tag).toBe("incident-episode-created");
+      expect(message.data).toMatchObject({
+        type: "incident-episode-created",
+        entityType: "incident-episode",
+      });
+    });
+  });
+
+  describe("createIncidentNotePostedNotification - note visibility", () => {
+    test("a private note reads as Private in title, body and payload", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentNotePostedNotification({
+          incidentTitle: "API down",
+          projectName: "Acme",
+          isPrivateNote: true,
+          incidentViewLink: "https://x/i/1",
+          incidentNumberWithPrefix: "INC-5",
+        });
+
+      expect(message.title).toBe(
+        "Private Note Added: Incident INC-5 - API down",
+      );
+      expect(message.body).toContain("A private note has been posted");
+      expect(message.data).toMatchObject({ isPrivateNote: true });
+    });
+
+    test("a public note reads as Public - the visibility is not swapped", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createIncidentNotePostedNotification({
+          incidentTitle: "API down",
+          projectName: "Acme",
+          isPrivateNote: false,
+          incidentViewLink: "https://x/i/1",
+        });
+
+      expect(message.title).toContain("Public Note Added");
+      expect(message.body).toContain("A public note has been posted");
+      expect(message.data).toMatchObject({ isPrivateNote: false });
+    });
+  });
+
+  describe("on-call policy membership notifications", () => {
+    test("added names the policy and uses the added tag", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyAddedNotification({
+          policyName: "Primary",
+        });
+
+      expect(message.title).toBe("Added to On-Call Policy");
+      expect(message.body).toContain(
+        "added to the on-call duty policy Primary",
+      );
+      expect(message.tag).toBe("on-call-policy-added");
+      expect(message.requireInteraction).toBe(false);
+    });
+
+    test("removed names the policy and uses the removed tag", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyRemovedNotification({
+          policyName: "Primary",
+        });
+
+      expect(message.title).toBe("Removed from On-Call Policy");
+      expect(message.body).toContain(
+        "removed from the on-call duty policy Primary",
+      );
+      expect(message.tag).toBe("on-call-policy-removed");
+    });
+
+    test("added and removed are distinguishable - different title, body and tag", () => {
+      const added: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyAddedNotification({
+          policyName: "Primary",
+        });
+      const removed: PushNotificationMessage =
+        PushNotificationUtil.createOnCallPolicyRemovedNotification({
+          policyName: "Primary",
+        });
+
+      expect(added.title).not.toBe(removed.title);
+      expect(added.body).not.toBe(removed.body);
+      expect(added.tag).not.toBe(removed.tag);
+    });
+  });
+
+  describe("createProbeStatusChangedNotification - the conditional click target", () => {
+    test("without a clickAction, no url/clickAction is wired", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeStatusChangedNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "connected",
+        });
+
+      expect(message.title).toBe("Probe connected: eu-west");
+      expect(message.clickAction).toBeUndefined();
+      expect(message.url).toBeUndefined();
+      expect(message.data).not.toHaveProperty("url");
+    });
+
+    test("with a clickAction, it is mirrored onto url and into the payload", () => {
+      const link: string = "https://dashboard/probe/eu-west";
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeStatusChangedNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "disconnected",
+          clickAction: link,
+        });
+
+      expect(message.title).toBe("Probe disconnected: eu-west");
+      expect(message.clickAction).toBe(link);
+      expect(message.url).toBe(link);
+      expect(message.data).toMatchObject({ url: link });
+    });
+  });
+
+  describe("createMonitorProbeStatusNotification", () => {
+    test("passes title/body/tag straight through and stamps the type", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createMonitorProbeStatusNotification({
+          title: "Monitor degraded",
+          body: "eu-west probe cannot reach API",
+          tag: "monitor-probe-status-degraded",
+          monitorId: "m1",
+          monitorName: "API",
+        });
+
+      expect(message.title).toBe("Monitor degraded");
+      expect(message.body).toBe("eu-west probe cannot reach API");
+      expect(message.tag).toBe("monitor-probe-status-degraded");
+      expect(message.requireInteraction).toBe(false);
+      expect(message.data).toMatchObject({
+        type: "monitor-probe-status",
+        monitorId: "m1",
+        monitorName: "API",
+      });
+    });
+  });
+});

package/Tests/Server/Utils/StatusPageContentSecurityPolicy.test.ts

@@ -0,0 +1,136 @@
+import applyStatusPageContentSecurityPolicy, {
+  isStatusPageFallbackDocumentPath,
+  STATUS_PAGE_CONTENT_SECURITY_POLICY_HEADER_NAME,
+  STATUS_PAGE_FALLBACK_CONTENT_SECURITY_POLICY,
+} from "../../../Server/Utils/StatusPageContentSecurityPolicy";
+import { ExpressRequest, ExpressResponse } from "../../../Server/Utils/Express";
+import { describe, expect, it, jest } from "@jest/globals";
+
+type FakeResponse = {
+  set: ReturnType<typeof jest.fn>;
+  headersSent: boolean;
+};
+
+function fakeRequest(path: string): ExpressRequest {
+  return { path } as unknown as ExpressRequest;
+}
+
+function fakeResponse(headersSent: boolean = false): FakeResponse {
+  return {
+    set: jest.fn(),
+    headersSent,
+  };
+}
+
+function policyDirectives(): Map<string, Array<string>> {
+  const directives: Map<string, Array<string>> = new Map();
+
+  for (const rawDirective of STATUS_PAGE_FALLBACK_CONTENT_SECURITY_POLICY.split(
+    ";",
+  )) {
+    const parts: Array<string> = rawDirective.trim().split(/\s+/);
+    const name: string | undefined = parts.shift();
+
+    if (name) {
+      directives.set(name, parts);
+    }
+  }
+
+  return directives;
+}
+
+describe("status page fallback Content Security Policy", () => {
+  it.each([
+    "/status-page",
+    "/status-page/",
+    "/status-page/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+    "/status-page/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/incidents",
+    "/status-page/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee?lang=en",
+  ])("classifies %s as a fallback document path", (path: string) => {
+    expect(isStatusPageFallbackDocumentPath(path)).toBe(true);
+  });
+
+  it.each([
+    "",
+    "/",
+    "/incidents",
+    "/rss",
+    "/llms.txt",
+    "/status-page-api/master-page/id",
+    "/status-pages/id",
+  ])(
+    "does not classify custom-domain or sibling path %s as fallback",
+    (path: string) => {
+      expect(isStatusPageFallbackDocumentPath(path)).toBe(false);
+    },
+  );
+
+  it("sets the policy on a fallback document", () => {
+    const res: FakeResponse = fakeResponse();
+
+    applyStatusPageContentSecurityPolicy(
+      fakeRequest("/status-page/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee"),
+      res as unknown as ExpressResponse,
+    );
+
+    expect(res.set).toHaveBeenCalledTimes(1);
+    expect(res.set).toHaveBeenCalledWith(
+      STATUS_PAGE_CONTENT_SECURITY_POLICY_HEADER_NAME,
+      STATUS_PAGE_FALLBACK_CONTENT_SECURITY_POLICY,
+    );
+  });
+
+  it("leaves a custom-domain document unchanged", () => {
+    const res: FakeResponse = fakeResponse();
+
+    applyStatusPageContentSecurityPolicy(
+      fakeRequest("/"),
+      res as unknown as ExpressResponse,
+    );
+
+    expect(res.set).not.toHaveBeenCalled();
+  });
+
+  it("does not touch a response whose headers were already sent", () => {
+    const res: FakeResponse = fakeResponse(true);
+
+    applyStatusPageContentSecurityPolicy(
+      fakeRequest("/status-page/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee"),
+      res as unknown as ExpressResponse,
+    );
+
+    expect(res.set).not.toHaveBeenCalled();
+  });
+
+  it("blocks dynamic JavaScript evaluation", () => {
+    const scriptSources: Array<string> =
+      policyDirectives().get("script-src") || [];
+
+    expect(scriptSources).not.toContain("'unsafe-eval'");
+    expect(STATUS_PAGE_FALLBACK_CONTENT_SECURITY_POLICY).not.toContain(
+      "unsafe-eval",
+    );
+  });
+
+  it("blocks inline event-handler attributes even though template scripts remain inline", () => {
+    const directives: Map<string, Array<string>> = policyDirectives();
+
+    expect(directives.get("script-src")).toContain("'unsafe-inline'");
+    expect(directives.get("script-src-attr")).toEqual(["'none'"]);
+  });
+
+  it("keeps the template bundle and HTTPS Tag Manager dependencies loadable", () => {
+    const scriptSources: Array<string> =
+      policyDirectives().get("script-src") || [];
+
+    expect(scriptSources).toContain("'self'");
+    expect(scriptSources).toContain("https:");
+  });
+
+  it("forbids plugin documents and attacker-controlled base URLs", () => {
+    const directives: Map<string, Array<string>> = policyDirectives();
+
+    expect(directives.get("object-src")).toEqual(["'none'"]);
+    expect(directives.get("base-uri")).toEqual(["'none'"]);
+  });
+});