@oneuptime/common 12.0.13 → 12.0.15

package/Tests/Types/NetworkDevice/NetworkDeviceLinkRuleScope.test.ts

@@ -0,0 +1,215 @@
+import NetworkDeviceLinkRuleScope, {
+  NetworkDeviceLinkRuleScopeUtil,
+} from "../../../Types/NetworkDevice/NetworkDeviceLinkRuleScope";
+
+/*
+ * `scope` was added to a table that already had rules in it, so every rule
+ * written before the column existed holds NULL — and each of those rules is
+ * currently drawing a topology somebody has already looked at and trusted.
+ * NULL therefore has to read as Project, because Project is exactly what
+ * those rules have always meant: one parent across whatever device set the
+ * query handed the resolver. Read NULL as Site instead and every legacy rule
+ * quietly starts asking a different question, re-pointing cables on maps
+ * nobody re-opened. That is why the default lives in `parse` rather than in a
+ * `=== "Site"` comparison scattered over the call sites: one place to be
+ * right, and it is pinned here.
+ *
+ * The mirror of the same worry is the unrecognised value. The column is free
+ * text (the NetworkDeviceMonitoringMethod precedent), so a typo, an older
+ * client, or a future scope name that this build has never heard of can all
+ * land in it. Every one of them has to fall back to the behaviour that was
+ * already on screen rather than to the new one.
+ */
+describe("NetworkDeviceLinkRuleScope enum", () => {
+  /*
+   * These strings are persisted values, not display labels. Renaming one is
+   * a silent data migration: every row already holding the old spelling stops
+   * being recognised and — by the fallback above — quietly reverts to
+   * Project, with no error anywhere to say so. Change these only alongside a
+   * migration that rewrites the column.
+   */
+  test("Project is persisted as the string Project", () => {
+    expect(NetworkDeviceLinkRuleScope.Project).toBe("Project");
+  });
+
+  test("Site is persisted as the string Site", () => {
+    expect(NetworkDeviceLinkRuleScope.Site).toBe("Site");
+  });
+
+  test("has exactly the two known scopes", () => {
+    expect(Object.values(NetworkDeviceLinkRuleScope).sort()).toEqual([
+      "Project",
+      "Site",
+    ]);
+  });
+});
+
+/*
+ * One table, two consumers. `parse` and `isSiteScoped` are asserted against
+ * the same rows further down so the pair cannot drift apart: a caller that
+ * branches on `isSiteScoped` and a caller that switches on `parse` must never
+ * disagree about the same stored string.
+ */
+const PROJECT_INPUTS: Array<string | null | undefined> = [
+  // The pre-column rows, and the shapes an empty form field arrives as.
+  undefined,
+  null,
+  "",
+  "  ",
+  // The value written by anything that does set the column explicitly.
+  "Project",
+  "project",
+  "PROJECT",
+  " Project ",
+  /*
+   * Near-misses that must NOT be read as site scope. "Sites" and
+   * "site-scoped" are the plausible typo and the plausible rename; matching
+   * them loosely would turn a mistyped rule into one that silently redraws.
+   */
+  "Sites",
+  "site-scoped",
+  "anything",
+  // Falsy-looking text is still just unrecognised text, not a flag.
+  "0",
+  "false",
+];
+
+const SITE_INPUTS: Array<string> = [
+  "Site",
+  "site",
+  "SITE",
+  " site ",
+  "  SiTe  ",
+];
+
+interface ScopeCase {
+  value: string | null | undefined;
+  expected: NetworkDeviceLinkRuleScope;
+}
+
+const ALL_CASES: Array<ScopeCase> = [
+  ...PROJECT_INPUTS.map((value: string | null | undefined): ScopeCase => {
+    return { value: value, expected: NetworkDeviceLinkRuleScope.Project };
+  }),
+  ...SITE_INPUTS.map((value: string): ScopeCase => {
+    return { value: value, expected: NetworkDeviceLinkRuleScope.Site };
+  }),
+];
+
+describe("NetworkDeviceLinkRuleScopeUtil.parse", () => {
+  test.each(PROJECT_INPUTS)(
+    "reads %p as Project",
+    (value: string | null | undefined) => {
+      expect(NetworkDeviceLinkRuleScopeUtil.parse(value)).toBe(
+        NetworkDeviceLinkRuleScope.Project,
+      );
+    },
+  );
+
+  test.each(SITE_INPUTS)(
+    "reads %p as Site, case- and whitespace-insensitively",
+    (value: string) => {
+      expect(NetworkDeviceLinkRuleScopeUtil.parse(value)).toBe(
+        NetworkDeviceLinkRuleScope.Site,
+      );
+    },
+  );
+
+  /*
+   * Only an exact (trimmed, lowercased) "site" opts in. Substring matching
+   * would make "not site" or "site (deprecated)" flip the rule's meaning,
+   * which is the one direction of mistake this type refuses to make.
+   */
+  test("does not treat a string merely containing 'site' as site-scoped", () => {
+    expect(NetworkDeviceLinkRuleScopeUtil.parse("per site")).toBe(
+      NetworkDeviceLinkRuleScope.Project,
+    );
+    expect(NetworkDeviceLinkRuleScopeUtil.parse("not site")).toBe(
+      NetworkDeviceLinkRuleScope.Project,
+    );
+  });
+
+  /*
+   * The return value is always one of the two enum members — never the raw
+   * column text passed straight back. Callers switch on it, and a passthrough
+   * would send an unrecognised spelling into a branch that does not exist.
+   */
+  test("returns an enum member for every case in the table, never the raw input", () => {
+    for (const testCase of ALL_CASES) {
+      const parsed: NetworkDeviceLinkRuleScope =
+        NetworkDeviceLinkRuleScopeUtil.parse(testCase.value);
+
+      expect(Object.values(NetworkDeviceLinkRuleScope)).toContain(parsed);
+    }
+  });
+
+  /*
+   * The parser sits in the middle of rendering a topology map: throwing here
+   * would take out the whole map over one bad cell, when the safe answer
+   * (Project, what the rule drew yesterday) is right there. So nothing in the
+   * declared signature may throw — and neither may the falsy non-string
+   * shapes a loosely typed caller or a hand-rolled JSON body can smuggle past
+   * TypeScript, which the `|| ""` guard absorbs.
+   */
+  test("never throws for any value in or near its declared signature", () => {
+    const inputs: Array<string | null | undefined> = [
+      ...ALL_CASES.map((testCase: ScopeCase): string | null | undefined => {
+        return testCase.value;
+      }),
+      "\tSITE\n",
+      "\n  project  \t",
+      "Site\u0000",
+      "🙂",
+    ];
+
+    for (const input of inputs) {
+      expect((): NetworkDeviceLinkRuleScope => {
+        return NetworkDeviceLinkRuleScopeUtil.parse(input);
+      }).not.toThrow();
+    }
+
+    /*
+     * Not strings at all. 0/false/NaN are what a JSON body or a permissive
+     * ORM can hand over in place of "no scope set", and they have to land on
+     * the same safe default rather than blow up.
+     */
+    const nonStrings: Array<unknown> = [0, false, NaN];
+
+    for (const input of nonStrings) {
+      expect(
+        NetworkDeviceLinkRuleScopeUtil.parse(input as unknown as string),
+      ).toBe(NetworkDeviceLinkRuleScope.Project);
+    }
+  });
+});
+
+describe("NetworkDeviceLinkRuleScopeUtil.isSiteScoped", () => {
+  test.each(SITE_INPUTS)("is true for %p", (value: string) => {
+    expect(NetworkDeviceLinkRuleScopeUtil.isSiteScoped(value)).toBe(true);
+  });
+
+  test.each(PROJECT_INPUTS)(
+    "is false for %p",
+    (value: string | null | undefined) => {
+      expect(NetworkDeviceLinkRuleScopeUtil.isSiteScoped(value)).toBe(false);
+    },
+  );
+
+  /*
+   * The two entry points are asserted against the same table in the same
+   * loop, so neither can be extended (a new alias, a new scope) without the
+   * other. `NetworkDeviceLinkRuleUtil` branches on `isSiteScoped` while the
+   * dashboard's rule list renders off it too — if they ever disagreed, a rule
+   * would be labelled one way and resolved the other.
+   */
+  test("agrees with parse on every case in the table", () => {
+    for (const testCase of ALL_CASES) {
+      expect(NetworkDeviceLinkRuleScopeUtil.parse(testCase.value)).toBe(
+        testCase.expected,
+      );
+      expect(NetworkDeviceLinkRuleScopeUtil.isSiteScoped(testCase.value)).toBe(
+        testCase.expected === NetworkDeviceLinkRuleScope.Site,
+      );
+    }
+  });
+});

package/Tests/Types/Service/ServiceLanguage.test.ts

@@ -0,0 +1,255 @@
+import {
+  SERVICE_LANGUAGE_DISPLAY_NAMES,
+  ServiceLanguage,
+  detectServiceLanguage,
+} from "../../../Types/Service/ServiceLanguage";
+import TechStack from "../../../Types/Service/TechStack";
+
+/*
+ * Which runtime a service is written in, decided from three sources of
+ * evidence of decreasing trustworthiness.
+ *
+ * This used to only pick which charts to draw on the service overview, where
+ * a wrong answer is a chart with no data in it. It now also picks which
+ * monitors OneUptime recommends, where a wrong answer is a monitor that
+ * queries a metric the service never emits and therefore never fires — a
+ * silent gap that reads as coverage. Every case below is about the difference
+ * between "we know" and "we are guessing".
+ */
+
+const ALL_LANGUAGES: Array<ServiceLanguage> = Object.keys(
+  SERVICE_LANGUAGE_DISPLAY_NAMES,
+) as Array<ServiceLanguage>;
+
+describe("detectServiceLanguage", () => {
+  describe("precedence between the three sources", () => {
+    /*
+     * The order is not arbitrary. `telemetry.sdk.language` is stamped by the
+     * SDK inside the process, so it describes what the process actually runs
+     * on. `process.runtime.name` is the same information one hop later.
+     * The tech stack is a human's answer typed into a form, which can be
+     * months out of date. Each test below sets up a deliberate disagreement
+     * so the winner is unambiguous.
+     */
+    it("prefers the SDK language over the runtime name", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "go",
+          runtimeName: "OpenJDK Runtime Environment",
+        }),
+      ).toBe("go");
+    });
+
+    it("prefers the SDK language over the tech stack", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "python",
+          techStack: [TechStack.Java],
+        }),
+      ).toBe("python");
+    });
+
+    it("prefers the runtime name over the tech stack", () => {
+      expect(
+        detectServiceLanguage({
+          runtimeName: "node",
+          techStack: [TechStack.Java],
+        }),
+      ).toBe("nodejs");
+    });
+
+    it("falls through to the tech stack when telemetry says nothing", () => {
+      expect(
+        detectServiceLanguage({
+          techStack: [TechStack.Rust],
+        }),
+      ).toBe("rust");
+    });
+  });
+
+  describe("the SDK language attribute", () => {
+    it.each(ALL_LANGUAGES)("recognises %s", (language: ServiceLanguage) => {
+      expect(detectServiceLanguage({ telemetrySdkLanguage: language })).toBe(
+        language,
+      );
+    });
+
+    it("is matched case-insensitively and ignores surrounding whitespace", () => {
+      expect(
+        detectServiceLanguage({ telemetrySdkLanguage: "  DotNet  " }),
+      ).toBe("dotnet");
+    });
+
+    /*
+     * The important negative case. An unrecognised value must NOT be returned
+     * verbatim — it would be a string that looks like a `ServiceLanguage` to
+     * every consumer and matches no template set, so the recommendations page
+     * would show nothing at all rather than the language-agnostic set.
+     */
+    it("does not pass an unrecognised SDK language through", () => {
+      expect(
+        detectServiceLanguage({ telemetrySdkLanguage: "cobol" }),
+      ).toBeNull();
+    });
+
+    it("falls through to the other sources when the SDK language is unknown", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "cobol",
+          techStack: [TechStack.Go],
+        }),
+      ).toBe("go");
+    });
+  });
+
+  describe("the runtime name markers", () => {
+    it.each([
+      ["OpenJDK 64-Bit Server VM", "java"],
+      ["GraalVM CE", "java"],
+      ["Java HotSpot(TM) 64-Bit Server VM", "java"],
+      [".NET 9.0.0", "dotnet"],
+      ["dotnet", "dotnet"],
+      ["node", "nodejs"],
+      ["Deno", "nodejs"],
+      ["bun", "nodejs"],
+      ["CPython", "python"],
+      ["PyPy", "python"],
+      ["BEAM", "erlang"],
+      ["Erlang/OTP 26", "erlang"],
+      ["ruby", "ruby"],
+      ["PHP 8.3", "php"],
+      ["rustc", "rust"],
+      ["swift", "swift"],
+      ["go", "go"],
+    ])(
+      "maps runtime name %s to %s",
+      (runtimeName: string, expected: string) => {
+        expect(detectServiceLanguage({ runtimeName: runtimeName })).toBe(
+          expected,
+        );
+      },
+    );
+
+    /*
+     * `go` is a two-letter substring, so it appears inside plenty of words —
+     * "GraalVM" does not contain it, but the ordering still matters and this
+     * pins it: the JVM markers are checked first, so a runtime string that
+     * contains both loses to the more specific one.
+     */
+    it("checks specific markers before the two-letter go marker", () => {
+      expect(
+        detectServiceLanguage({ runtimeName: "GraalVM for Go interop" }),
+      ).toBe("java");
+    });
+
+    it("returns null for a runtime name it does not recognise", () => {
+      expect(detectServiceLanguage({ runtimeName: "SomeVM 1.0" })).toBeNull();
+    });
+  });
+
+  describe("the tech stack fallback", () => {
+    it("maps Kotlin to java, because the runtime is what matters", () => {
+      expect(detectServiceLanguage({ techStack: [TechStack.Kotlin] })).toBe(
+        "java",
+      );
+    });
+
+    it("maps C# to dotnet", () => {
+      expect(detectServiceLanguage({ techStack: [TechStack.CSharp] })).toBe(
+        "dotnet",
+      );
+    });
+
+    it.each([TechStack.TypeScript, TechStack.JavaScript, TechStack.NodeJS])(
+      "maps %s to nodejs",
+      (techStack: TechStack) => {
+        expect(detectServiceLanguage({ techStack: [techStack] })).toBe(
+          "nodejs",
+        );
+      },
+    );
+
+    it("maps React to webjs rather than to nodejs", () => {
+      expect(detectServiceLanguage({ techStack: [TechStack.React] })).toBe(
+        "webjs",
+      );
+    });
+
+    it("takes the first entry that maps to a runtime", () => {
+      expect(
+        detectServiceLanguage({
+          techStack: [TechStack.Shell, TechStack.Markdown, TechStack.Go],
+        }),
+      ).toBe("go");
+    });
+
+    it.each([TechStack.Shell, TechStack.Markdown, TechStack.Other])(
+      "does not invent a runtime for %s",
+      (techStack: TechStack) => {
+        expect(detectServiceLanguage({ techStack: [techStack] })).toBeNull();
+      },
+    );
+  });
+
+  describe("when nothing identifies the runtime", () => {
+    /*
+     * Null, never a default. A default would hand every unidentified service
+     * one language's recommendations — monitors on metrics it does not emit,
+     * presented as if OneUptime had established what it runs on.
+     */
+    it("returns null for no input at all", () => {
+      expect(detectServiceLanguage({})).toBeNull();
+    });
+
+    it("returns null for empty strings and an empty tech stack", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "",
+          runtimeName: "",
+          techStack: [],
+        }),
+      ).toBeNull();
+    });
+
+    it("returns null for whitespace-only telemetry values", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: "   ",
+          runtimeName: "  ",
+        }),
+      ).toBeNull();
+    });
+
+    it("returns null for explicitly undefined fields", () => {
+      expect(
+        detectServiceLanguage({
+          telemetrySdkLanguage: undefined,
+          runtimeName: undefined,
+          techStack: undefined,
+        }),
+      ).toBeNull();
+    });
+  });
+});
+
+describe("SERVICE_LANGUAGE_DISPLAY_NAMES", () => {
+  it("names every language, non-blank", () => {
+    expect(ALL_LANGUAGES.length).toBeGreaterThan(0);
+
+    for (const language of ALL_LANGUAGES) {
+      expect(
+        SERVICE_LANGUAGE_DISPLAY_NAMES[language].trim().length,
+      ).toBeGreaterThan(0);
+    }
+  });
+
+  it("gives each language a distinct display name", () => {
+    const names: Array<string> = ALL_LANGUAGES.map(
+      (language: ServiceLanguage) => {
+        return SERVICE_LANGUAGE_DISPLAY_NAMES[language];
+      },
+    );
+
+    expect(new Set<string>(names).size).toBe(names.length);
+  });
+});

package/Tests/Types/TextRandomGeneration.test.ts

@@ -0,0 +1,211 @@
+import Text from "../../Types/Text";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * GHSA-5cr8-vph4-3hrf, CWE-330.
+ *
+ * Text.generateRandomNumber is what mints notification-channel verification
+ * codes. It used to draw from the literal string "12134567890" using
+ * Math.random, which is wrong twice over: the alphabet has "1" in it twice so
+ * the digits are not equally likely, and Math.random is a non-cryptographic
+ * PRNG whose state is recoverable from its own output.
+ *
+ * Neither property can be observed by looking at one value, which is why they
+ * survived. The tests below observe them the only ways available: by counting
+ * a large sample for bias, and by watching which source the generator actually
+ * pulls from.
+ */
+describe("Text random generation", () => {
+  describe("generateRandomNumber", () => {
+    it("emits only digits, at the requested length", () => {
+      for (let length: number = 1; length <= 12; length++) {
+        const value: string = Text.generateRandomNumber(length);
+
+        expect(value).toHaveLength(length);
+        expect(value).toMatch(/^[0-9]+$/);
+      }
+    });
+
+    it("defaults to ten characters", () => {
+      expect(Text.generateRandomNumber()).toHaveLength(10);
+    });
+
+    /*
+     * The direct regression. With the old alphabet the digit "1" appeared
+     * twice in an eleven-character string, so it came up 2/11 of the time
+     * against 1/11 for every other digit — and "8" appeared once, like the
+     * rest, only because the typo happened to leave it in.
+     *
+     * 60,000 digits puts the expected count per digit at 6,000 with a
+     * standard deviation of about 73. The old generator produced ~10,909 ones
+     * and ~5,454 of everything else, so the bound below is enormously loose
+     * for a fair generator and enormously tight for the broken one.
+     */
+    it("draws every digit with equal probability", () => {
+      const sampleSize: number = 10000;
+      const digitsPerSample: number = 6;
+      const counts: Record<string, number> = {};
+
+      for (let i: number = 0; i < sampleSize; i++) {
+        for (const digit of Text.generateRandomNumber(digitsPerSample)) {
+          counts[digit] = (counts[digit] || 0) + 1;
+        }
+      }
+
+      const totalDigits: number = sampleSize * digitsPerSample;
+      const expectedPerDigit: number = totalDigits / 10;
+
+      /*
+       * Every digit must actually appear — "8" was reachable before, but a
+       * future typo in the alphabet would show up here.
+       */
+      expect(Object.keys(counts).sort()).toEqual([
+        "0",
+        "1",
+        "2",
+        "3",
+        "4",
+        "5",
+        "6",
+        "7",
+        "8",
+        "9",
+      ]);
+
+      for (const digit of Object.keys(counts)) {
+        const count: number = counts[digit] as number;
+
+        /*
+         * Six sigma either way: a fair generator fails this about once in
+         * 500 million runs, the old one fails it every time.
+         */
+        expect(count).toBeGreaterThan(expectedPerDigit * 0.9);
+        expect(count).toBeLessThan(expectedPerDigit * 1.1);
+      }
+    });
+
+    /*
+     * Leading zeros are part of the code space. Dropping them — by going
+     * through a number, say — would quietly remove a tenth of it.
+     */
+    it("can produce codes with leading zeros", () => {
+      let sawLeadingZero: boolean = false;
+
+      for (let i: number = 0; i < 500; i++) {
+        if (Text.generateRandomNumber(6).startsWith("0")) {
+          sawLeadingZero = true;
+          break;
+        }
+      }
+
+      expect(sawLeadingZero).toBe(true);
+    });
+
+    /*
+     * The other half of CWE-330. Math.random is seeded per process and its
+     * internal state can be recovered from a handful of outputs, after which
+     * every future value is known exactly — no guessing required. Asserting
+     * on the SOURCE is the only way to pin this: any specific output is a
+     * legal output of either generator.
+     */
+    it("does not fall back to Math.random when a CSPRNG is available", () => {
+      const mathRandomSpy: jest.SpyInstance = jest.spyOn(Math, "random");
+
+      try {
+        for (let i: number = 0; i < 100; i++) {
+          Text.generateRandomNumber(6);
+        }
+
+        expect(mathRandomSpy).not.toHaveBeenCalled();
+      } finally {
+        mathRandomSpy.mockRestore();
+      }
+    });
+
+    it("takes its bytes from crypto.getRandomValues", () => {
+      const getRandomValuesSpy: jest.SpyInstance = jest.spyOn(
+        globalThis.crypto,
+        "getRandomValues",
+      );
+
+      try {
+        Text.generateRandomNumber(6);
+
+        expect(getRandomValuesSpy).toHaveBeenCalled();
+      } finally {
+        getRandomValuesSpy.mockRestore();
+      }
+    });
+
+    it("produces a different value practically every time", () => {
+      const seen: Set<string> = new Set<string>();
+
+      for (let i: number = 0; i < 1000; i++) {
+        seen.add(Text.generateRandomNumber(10));
+      }
+
+      /*
+       * Ten digits, a thousand draws: collisions are vanishingly unlikely,
+       * and a stuck generator would collapse this to 1.
+       */
+      expect(seen.size).toBe(1000);
+    });
+  });
+
+  describe("generateRandomText", () => {
+    it("emits only letters, at the requested length", () => {
+      for (let length: number = 1; length <= 40; length += 7) {
+        const value: string = Text.generateRandomText(length);
+
+        expect(value).toHaveLength(length);
+        expect(value).toMatch(/^[A-Za-z]+$/);
+      }
+    });
+
+    it("defaults to ten characters", () => {
+      expect(Text.generateRandomText()).toHaveLength(10);
+    });
+
+    it("does not fall back to Math.random when a CSPRNG is available", () => {
+      const mathRandomSpy: jest.SpyInstance = jest.spyOn(Math, "random");
+
+      try {
+        for (let i: number = 0; i < 100; i++) {
+          Text.generateRandomText(20);
+        }
+
+        expect(mathRandomSpy).not.toHaveBeenCalled();
+      } finally {
+        mathRandomSpy.mockRestore();
+      }
+    });
+
+    /*
+     * Both alphabets have 52 characters, which does NOT divide 256 — so
+     * `byte % 52` would be biased towards the first 48 letters. The rejection
+     * sampling is what removes that, and this is the test that would notice
+     * if somebody "simplified" it away.
+     */
+    it("draws every letter with roughly equal probability", () => {
+      const counts: Record<string, number> = {};
+      const totalCharacters: number = 52 * 2000;
+
+      for (let i: number = 0; i < 2000; i++) {
+        for (const character of Text.generateRandomText(52)) {
+          counts[character] = (counts[character] || 0) + 1;
+        }
+      }
+
+      expect(Object.keys(counts)).toHaveLength(52);
+
+      const expectedPerCharacter: number = totalCharacters / 52;
+
+      for (const character of Object.keys(counts)) {
+        const count: number = counts[character] as number;
+
+        expect(count).toBeGreaterThan(expectedPerCharacter * 0.85);
+        expect(count).toBeLessThan(expectedPerCharacter * 1.15);
+      }
+    });
+  });
+});