@oneuptime/common 12.0.15 → 12.0.16

package/Tests/Server/Utils/UserPermission/ProjectUserGrant.test.ts

@@ -0,0 +1,293 @@
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Permission.ProjectUser is what "is a member of this project" means. Nothing
+ * stores it — no TeamPermission row carries it — so it has to be added to a
+ * member's permission set as their session is resolved. Before this it was
+ * declared in the catalogue, referenced by a handful of models, and granted
+ * nowhere, which made every read list mentioning it a dead branch.
+ *
+ * Three things have to hold, and each has bitten a permission system before:
+ *   - a member gets it, exactly once, unrestricted;
+ *   - a snapshot cached before the grant existed still comes back with it (the
+ *     entry lives for 30 days unless a membership change rewrites it, so a
+ *     signed-in user would otherwise stay locked out for weeks after deploy);
+ *   - a caller who is only *part way* into the project — the SSO-required,
+ *     SSO-not-satisfied path — does not get it.
+ *
+ * GlobalCache is mocked at the module boundary: the real one opens Redis.
+ */
+
+const mockGetJSONObject: jest.Mock = jest.fn();
+const mockSetJSON: jest.Mock = jest.fn();
+
+jest.mock("../../../../Server/Infrastructure/GlobalCache", () => {
+  return {
+    __esModule: true,
+    default: {
+      getJSONObject: (...args: Array<unknown>) => {
+        return mockGetJSONObject(...args);
+      },
+      setJSON: (...args: Array<unknown>) => {
+        return mockSetJSON(...args);
+      },
+    },
+  };
+});
+
+import UserPermissionUtil from "../../../../Server/Utils/UserPermission/UserPermission";
+
+const projectId: ObjectID = ObjectID.generate();
+const userId: ObjectID = ObjectID.generate();
+
+type MakePermissionFunction = (
+  permissions: Array<Permission>,
+) => UserTenantAccessPermission;
+
+const makePermission: MakePermissionFunction = (
+  permissions: Array<Permission>,
+): UserTenantAccessPermission => {
+  return {
+    projectId,
+    isBlockPermission: false,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission): UserPermission => {
+      return {
+        permission,
+        labelIds: [],
+        isBlockPermission: false,
+        _type: "UserPermission",
+      };
+    }),
+  };
+};
+
+type PermissionNamesFunction = (
+  permission: UserTenantAccessPermission,
+) => Array<Permission>;
+
+const permissionNames: PermissionNamesFunction = (
+  permission: UserTenantAccessPermission,
+): Array<Permission> => {
+  return permission.permissions.map((row: UserPermission) => {
+    return row.permission;
+  });
+};
+
+describe("UserPermissionUtil.withProjectUserPermission", () => {
+  test("adds ProjectUser to a member whose teams grant only a domain role", () => {
+    const permission: UserTenantAccessPermission =
+      UserPermissionUtil.withProjectUserPermission(
+        makePermission([Permission.MonitorViewer]),
+      );
+
+    expect(permissionNames(permission)).toEqual([
+      Permission.MonitorViewer,
+      Permission.ProjectUser,
+    ]);
+  });
+
+  /*
+   * Unrestricted, because a label-scoped row would make the shared models
+   * label-filtered — and none of them carry labels, so the filter would match
+   * nothing and the saved views would silently come back empty.
+   */
+  test("the added row is unrestricted and is not a block", () => {
+    const permission: UserTenantAccessPermission =
+      UserPermissionUtil.withProjectUserPermission(makePermission([]));
+
+    const row: UserPermission | undefined = permission.permissions.find(
+      (candidate: UserPermission) => {
+        return candidate.permission === Permission.ProjectUser;
+      },
+    );
+
+    expect(row).toBeDefined();
+    expect(row?.labelIds).toEqual([]);
+    expect(row?.isBlockPermission).toBe(false);
+    expect(row?._type).toBe("UserPermission");
+  });
+
+  test("is idempotent - refresh then cache read must not stack duplicates", () => {
+    let permission: UserTenantAccessPermission = makePermission([
+      Permission.MonitorViewer,
+    ]);
+
+    permission = UserPermissionUtil.withProjectUserPermission(permission);
+    permission = UserPermissionUtil.withProjectUserPermission(permission);
+    permission = UserPermissionUtil.withProjectUserPermission(permission);
+
+    expect(
+      permissionNames(permission).filter((name: Permission) => {
+        return name === Permission.ProjectUser;
+      }),
+    ).toHaveLength(1);
+  });
+
+  /*
+   * The snapshot handed in may have come straight out of the cache and be
+   * shared with whatever else is holding it. Appending in place would grow that
+   * array by one row on every read of the same object.
+   */
+  test("does not mutate the permission set it was given", () => {
+    const original: UserTenantAccessPermission = makePermission([
+      Permission.MonitorViewer,
+    ]);
+
+    const permission: UserTenantAccessPermission =
+      UserPermissionUtil.withProjectUserPermission(original);
+
+    expect(permissionNames(original)).toEqual([Permission.MonitorViewer]);
+    expect(permissionNames(permission)).toEqual([
+      Permission.MonitorViewer,
+      Permission.ProjectUser,
+    ]);
+  });
+
+  test("leaves an administrator's existing rows exactly as they were", () => {
+    const original: UserTenantAccessPermission = makePermission([
+      Permission.ProjectAdmin,
+      Permission.CreateProjectMonitor,
+    ]);
+    const labelId: ObjectID = ObjectID.generate();
+    original.permissions[0]!.labelIds = [labelId];
+
+    const permission: UserTenantAccessPermission =
+      UserPermissionUtil.withProjectUserPermission(original);
+
+    expect(permission.permissions[0]!.permission).toBe(Permission.ProjectAdmin);
+    expect(permission.permissions[0]!.labelIds).toEqual([labelId]);
+    expect(permission.permissions[1]!.permission).toBe(
+      Permission.CreateProjectMonitor,
+    );
+  });
+
+  /*
+   * A team can block a permission for its members. Nothing blocks ProjectUser
+   * today, but if a row for it is already present the helper must leave that
+   * row alone rather than add a second, granting one.
+   */
+  test("does not override an existing ProjectUser row", () => {
+    const original: UserTenantAccessPermission = makePermission([
+      Permission.ProjectUser,
+    ]);
+    original.permissions[0]!.isBlockPermission = true;
+
+    const permission: UserTenantAccessPermission =
+      UserPermissionUtil.withProjectUserPermission(original);
+
+    expect(permission.permissions).toHaveLength(1);
+    expect(permission.permissions[0]!.isBlockPermission).toBe(true);
+  });
+});
+
+describe("UserPermissionUtil.getDefaultUserTenantAccessPermission", () => {
+  /*
+   * This is also the permission set UserAuthorization hands a user who owes the
+   * project an SSO login. They are on the roster but have not proved who they
+   * are for this project yet, so they are not a project user.
+   */
+  test("does not grant ProjectUser", () => {
+    const permission: UserTenantAccessPermission =
+      UserPermissionUtil.getDefaultUserTenantAccessPermission(projectId);
+
+    expect(permissionNames(permission)).toEqual([
+      Permission.CurrentUser,
+      Permission.UnAuthorizedSsoUser,
+    ]);
+  });
+});
+
+describe("UserPermissionUtil.getUserTenantAccessPermissionFromCache", () => {
+  beforeEach(() => {
+    mockGetJSONObject.mockReset();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("adds ProjectUser to a snapshot written before the grant existed", async () => {
+    mockGetJSONObject.mockResolvedValue(
+      makePermission([Permission.MonitorViewer]) as never,
+    );
+
+    const permission: UserTenantAccessPermission | null =
+      await UserPermissionUtil.getUserTenantAccessPermissionFromCache(
+        userId,
+        projectId,
+      );
+
+    expect(permission).not.toBeNull();
+    expect(permissionNames(permission!)).toContain(Permission.ProjectUser);
+    expect(permission!._type).toBe("UserTenantAccessPermission");
+  });
+
+  test("does not duplicate the row on a snapshot that already has it", async () => {
+    mockGetJSONObject.mockResolvedValue(
+      makePermission([
+        Permission.MonitorViewer,
+        Permission.ProjectUser,
+      ]) as never,
+    );
+
+    const permission: UserTenantAccessPermission | null =
+      await UserPermissionUtil.getUserTenantAccessPermissionFromCache(
+        userId,
+        projectId,
+      );
+
+    expect(
+      permissionNames(permission!).filter((name: Permission) => {
+        return name === Permission.ProjectUser;
+      }),
+    ).toHaveLength(1);
+  });
+
+  /*
+   * A cache miss must stay a miss. Returning a permission set carrying only
+   * ProjectUser would turn "this user is not in the project" into "this user is
+   * a member with no roles".
+   */
+  test("a cache miss is still a miss", async () => {
+    mockGetJSONObject.mockResolvedValue(null as never);
+
+    expect(
+      await UserPermissionUtil.getUserTenantAccessPermissionFromCache(
+        userId,
+        projectId,
+      ),
+    ).toBeNull();
+  });
+
+  test("survives a stored snapshot with no permissions array", async () => {
+    mockGetJSONObject.mockResolvedValue({ projectId } as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await UserPermissionUtil.getUserTenantAccessPermissionFromCache(
+        userId,
+        projectId,
+      );
+
+    expect(permissionNames(permission!)).toEqual([Permission.ProjectUser]);
+  });
+
+  test("reads the delimited cache key, not a concatenation", async () => {
+    mockGetJSONObject.mockResolvedValue(null as never);
+
+    await UserPermissionUtil.getUserTenantAccessPermissionFromCache(
+      userId,
+      projectId,
+    );
+
+    expect(mockGetJSONObject).toHaveBeenCalledWith(
+      "project-permissions",
+      `${userId.toString()}:${projectId.toString()}`,
+    );
+  });
+});

package/Tests/Types/Monitor/MonitorStepInfraMonitorUtils.test.ts

@@ -0,0 +1,194 @@
+import MonitorStepCephMonitor, {
+  MonitorStepCephMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepCephMonitor";
+import MonitorStepDockerMonitor, {
+  MonitorStepDockerMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepDockerMonitor";
+import MonitorStepDockerSwarmMonitor, {
+  MonitorStepDockerSwarmMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepDockerSwarmMonitor";
+import MonitorStepHostMonitor, {
+  MonitorStepHostMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepHostMonitor";
+import MonitorStepIoTMonitor, {
+  IoTResourceScope,
+  MonitorStepIoTMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepIoTMonitor";
+import MonitorStepKubernetesMonitor, {
+  KubernetesResourceScope,
+  MonitorStepKubernetesMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepKubernetesMonitor";
+import MonitorStepPodmanMonitor, {
+  MonitorStepPodmanMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepPodmanMonitor";
+import MonitorStepProxmoxMonitor, {
+  MonitorStepProxmoxMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepProxmoxMonitor";
+import { JSONObject } from "../../../Types/JSON";
+import RollingTime from "../../../Types/RollingTime/RollingTime";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * The infrastructure monitor-step types (Host, Docker, Podman, Kubernetes,
+ * Ceph, IoT, Docker Swarm, Proxmox) each ship a small `*Util` class with
+ * getDefault / fromJSON / toJSON. getDefault seeds the monitor-step editor
+ * when a user first picks that monitor type, so two things it does are
+ * load-bearing and neither is obvious from the (near-identity) code:
+ *
+ *   1. THE DEFAULT ROLLING WINDOW. Every infra step defaults to
+ *      RollingTime.Past1Minute. That value is what a freshly created
+ *      metric monitor evaluates over until the user changes it; a silent
+ *      change to it would change the meaning of every new monitor. Pinned
+ *      per type so a copy-paste edit in one file is caught.
+ *
+ *   2. getDefault RETURNS A FRESH OBJECT GRAPH. The editor mutates the
+ *      returned object (typing an identifier, adding a filter). If
+ *      getDefault handed back a shared reference — or a shared nested
+ *      metricViewConfig — one monitor's edits would bleed into the next
+ *      default. Each call must yield independent objects all the way down.
+ */
+
+interface InfraMonitorUtil<T> {
+  getDefault: () => T;
+  fromJSON: (json: JSONObject) => T;
+  toJSON: (monitor: T) => JSONObject;
+}
+
+interface InfraCase {
+  name: string;
+  // The util under test. Typed loosely so the table can hold every variant.
+  util: InfraMonitorUtil<any>;
+  // The empty-string identifier field each default carries.
+  identifierField: string;
+}
+
+const CASES: Array<InfraCase> = [
+  {
+    name: "Host",
+    util: MonitorStepHostMonitorUtil as InfraMonitorUtil<MonitorStepHostMonitor>,
+    identifierField: "hostIdentifier",
+  },
+  {
+    name: "Docker",
+    util: MonitorStepDockerMonitorUtil as InfraMonitorUtil<MonitorStepDockerMonitor>,
+    identifierField: "hostIdentifier",
+  },
+  {
+    name: "Podman",
+    util: MonitorStepPodmanMonitorUtil as InfraMonitorUtil<MonitorStepPodmanMonitor>,
+    identifierField: "hostIdentifier",
+  },
+  {
+    name: "Kubernetes",
+    util: MonitorStepKubernetesMonitorUtil as InfraMonitorUtil<MonitorStepKubernetesMonitor>,
+    identifierField: "clusterIdentifier",
+  },
+  {
+    name: "Ceph",
+    util: MonitorStepCephMonitorUtil as InfraMonitorUtil<MonitorStepCephMonitor>,
+    identifierField: "clusterIdentifier",
+  },
+  {
+    name: "IoT",
+    util: MonitorStepIoTMonitorUtil as InfraMonitorUtil<MonitorStepIoTMonitor>,
+    identifierField: "fleetIdentifier",
+  },
+  {
+    name: "DockerSwarm",
+    util: MonitorStepDockerSwarmMonitorUtil as InfraMonitorUtil<MonitorStepDockerSwarmMonitor>,
+    identifierField: "clusterIdentifier",
+  },
+  {
+    name: "Proxmox",
+    util: MonitorStepProxmoxMonitorUtil as InfraMonitorUtil<MonitorStepProxmoxMonitor>,
+    identifierField: "clusterIdentifier",
+  },
+];
+
+describe("Infrastructure monitor-step getDefault contract", () => {
+  for (const testCase of CASES) {
+    describe(`MonitorStep${testCase.name}MonitorUtil`, () => {
+      it("defaults the rolling window to Past1Minute", () => {
+        const def: Record<string, unknown> = testCase.util.getDefault();
+        expect(def["rollingTime"]).toBe(RollingTime.Past1Minute);
+      });
+
+      it("defaults the identifier to an empty string", () => {
+        const def: Record<string, unknown> = testCase.util.getDefault();
+        expect(def[testCase.identifierField]).toBe("");
+      });
+
+      it("defaults to an empty metric view config", () => {
+        const def: Record<string, any> = testCase.util.getDefault();
+        expect(def["metricViewConfig"]).toEqual({
+          queryConfigs: [],
+          formulaConfigs: [],
+        });
+      });
+
+      it("returns a fresh object graph on every call", () => {
+        const first: Record<string, any> = testCase.util.getDefault();
+        const second: Record<string, any> = testCase.util.getDefault();
+
+        // Distinct top-level objects.
+        expect(first).not.toBe(second);
+        // Distinct nested metricViewConfig, so mutating one is isolated.
+        expect(first["metricViewConfig"]).not.toBe(second["metricViewConfig"]);
+
+        // Mutating the first default must not touch a later default.
+        first["metricViewConfig"].queryConfigs.push({ any: "thing" });
+        first[testCase.identifierField] = "edited";
+
+        const third: Record<string, any> = testCase.util.getDefault();
+        expect(third["metricViewConfig"].queryConfigs).toEqual([]);
+        expect(third[testCase.identifierField]).toBe("");
+      });
+    });
+  }
+});
+
+describe("Infrastructure monitor-step JSON round-trip", () => {
+  for (const testCase of CASES) {
+    it(`MonitorStep${testCase.name}MonitorUtil round-trips getDefault through to/fromJSON`, () => {
+      const def: any = testCase.util.getDefault();
+
+      const json: JSONObject = testCase.util.toJSON(def);
+      const restored: any = testCase.util.fromJSON(json);
+
+      // The value survives a serialize/deserialize cycle unchanged.
+      expect(restored).toEqual(def);
+    });
+
+    it(`MonitorStep${testCase.name}MonitorUtil preserves a populated identifier + rolling window`, () => {
+      const populated: Record<string, unknown> = {
+        ...(testCase.util.getDefault() as Record<string, unknown>),
+        [testCase.identifierField]: "prod-cluster-1",
+        rollingTime: RollingTime.Past1Hour,
+      };
+
+      const restored: Record<string, unknown> = testCase.util.fromJSON(
+        testCase.util.toJSON(populated),
+      ) as Record<string, unknown>;
+
+      expect(restored[testCase.identifierField]).toBe("prod-cluster-1");
+      expect(restored["rollingTime"]).toBe(RollingTime.Past1Hour);
+    });
+  }
+});
+
+describe("Infrastructure monitor-step scope enums", () => {
+  it("Kubernetes default scope is Cluster", () => {
+    const def: MonitorStepKubernetesMonitor =
+      MonitorStepKubernetesMonitorUtil.getDefault();
+    expect(def.resourceScope).toBe(KubernetesResourceScope.Cluster);
+  });
+
+  it("IoT scope enum values match the agent-stamped attribute strings", () => {
+    /*
+     * These strings equal the `iot.scope` datapoint attribute, so a rename
+     * here would silently break the worker's attribute-equality mapping.
+     */
+    expect(IoTResourceScope.Fleet).toBe("fleet");
+    expect(IoTResourceScope.Device).toBe("device");
+  });
+});

package/Tests/Types/Monitor/MonitorStepSecurityEventsMonitor.test.ts

@@ -0,0 +1,201 @@
+import MonitorStepSecurityEventsMonitor, {
+  MonitorStepSecurityEventsMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepSecurityEventsMonitor";
+import SecurityEvent from "../../../Models/AnalyticsModels/SecurityEvent";
+import InBetween from "../../../Types/BaseDatabase/InBetween";
+import Includes from "../../../Types/BaseDatabase/Includes";
+import Query from "../../../Types/BaseDatabase/Query";
+import Search from "../../../Types/BaseDatabase/Search";
+import OcsfSeverity from "../../../Types/SecurityEvent/OcsfSeverity";
+import ObjectID from "../../../Types/ObjectID";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * MonitorStepSecurityEventsMonitor is the security-events monitor step
+ * config: what the UI stores, what round-trips through MonitorStep JSON,
+ * and what toQuery turns into the SecurityEvent table filter the worker
+ * runs. These tests pin the default shape, the config -> query mapping
+ * (each populated field becomes exactly one filter, empty ones none), and
+ * the toJSON/fromJSON round-trip that must preserve ObjectIDs.
+ */
+
+const SERVICE_ID_A: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const SERVICE_ID_B: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+
+function buildConfig(
+  overrides: Partial<MonitorStepSecurityEventsMonitor> = {},
+): MonitorStepSecurityEventsMonitor {
+  return {
+    ...MonitorStepSecurityEventsMonitorUtil.getDefault(),
+    ...overrides,
+  };
+}
+
+describe("MonitorStepSecurityEventsMonitorUtil.getDefault", () => {
+  test("returns the empty config with a 60-second window", () => {
+    expect(MonitorStepSecurityEventsMonitorUtil.getDefault()).toEqual({
+      attributes: {},
+      messageContains: "",
+      severityNames: [],
+      classNames: [],
+      telemetryServiceIds: [],
+      lastXSecondsOfEvents: 60,
+    });
+  });
+});
+
+describe("MonitorStepSecurityEventsMonitorUtil.toQuery", () => {
+  test("an empty config produces only the time window filter", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(buildConfig());
+
+    expect(Object.keys(query)).toEqual(["time"]);
+
+    const time: InBetween<Date> = query.time as InBetween<Date>;
+    expect(time).toBeInstanceOf(InBetween);
+    expect(time.endValue.getTime() - time.startValue.getTime()).toBe(60 * 1000);
+  });
+
+  test("lastXSecondsOfEvents drives the InBetween window size", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ lastXSecondsOfEvents: 300 }),
+      );
+
+    const time: InBetween<Date> = query.time as InBetween<Date>;
+    expect(time.endValue.getTime() - time.startValue.getTime()).toBe(
+      300 * 1000,
+    );
+  });
+
+  test("a zero-second window produces no filters at all", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ lastXSecondsOfEvents: 0 }),
+      );
+
+    expect(query).toEqual({});
+  });
+
+  test("severityNames become an Includes filter on severityName", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({
+          severityNames: [OcsfSeverity.High, OcsfSeverity.Critical],
+        }),
+      );
+
+    const filter: Includes = query.severityName as Includes;
+    expect(filter).toBeInstanceOf(Includes);
+    expect(filter.values).toEqual([OcsfSeverity.High, OcsfSeverity.Critical]);
+  });
+
+  test("classNames become an Includes filter on className", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ classNames: ["Authentication", "Process Activity"] }),
+      );
+
+    const filter: Includes = query.className as Includes;
+    expect(filter).toBeInstanceOf(Includes);
+    expect(filter.values).toEqual(["Authentication", "Process Activity"]);
+  });
+
+  test("messageContains becomes a Search filter on message", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ messageContains: "failed login" }),
+      );
+
+    const filter: Search<string> = query.message as Search<string>;
+    expect(filter).toBeInstanceOf(Search);
+    expect(filter.toString()).toBe("failed login");
+  });
+
+  test("telemetryServiceIds become an Includes filter on primaryEntityId", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ telemetryServiceIds: [SERVICE_ID_A, SERVICE_ID_B] }),
+      );
+
+    const filter: Includes = query.primaryEntityId as Includes;
+    expect(filter).toBeInstanceOf(Includes);
+    expect(filter.values).toEqual([SERVICE_ID_A, SERVICE_ID_B]);
+  });
+
+  test("attributes pass through as-is", () => {
+    const attributes: MonitorStepSecurityEventsMonitor["attributes"] = {
+      env: "prod",
+      attempts: 3,
+      blocked: true,
+    };
+
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(buildConfig({ attributes }));
+
+    expect(query.attributes).toEqual(attributes);
+  });
+
+  test("empty attributes add no filter", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ lastXSecondsOfEvents: 0, attributes: {} }),
+      );
+
+    expect(query.attributes).toBeUndefined();
+  });
+});
+
+describe("MonitorStepSecurityEventsMonitorUtil toJSON/fromJSON", () => {
+  test("round-trips every field and revives ObjectIDs", () => {
+    const config: MonitorStepSecurityEventsMonitor = {
+      attributes: { env: "prod", attempts: 3, blocked: true },
+      messageContains: "failed login",
+      severityNames: [OcsfSeverity.High, OcsfSeverity.Critical],
+      classNames: ["Authentication"],
+      telemetryServiceIds: [SERVICE_ID_A, SERVICE_ID_B],
+      lastXSecondsOfEvents: 300,
+    };
+
+    const json: JSONObject =
+      MonitorStepSecurityEventsMonitorUtil.toJSON(config);
+    const roundTripped: MonitorStepSecurityEventsMonitor =
+      MonitorStepSecurityEventsMonitorUtil.fromJSON(json);
+
+    expect(roundTripped.attributes).toEqual(config.attributes);
+    expect(roundTripped.messageContains).toBe("failed login");
+    expect(roundTripped.severityNames).toEqual([
+      OcsfSeverity.High,
+      OcsfSeverity.Critical,
+    ]);
+    expect(roundTripped.classNames).toEqual(["Authentication"]);
+    expect(roundTripped.lastXSecondsOfEvents).toBe(300);
+
+    expect(roundTripped.telemetryServiceIds).toHaveLength(2);
+    for (const serviceId of roundTripped.telemetryServiceIds) {
+      expect(serviceId).toBeInstanceOf(ObjectID);
+    }
+    expect(
+      roundTripped.telemetryServiceIds.map((serviceId: ObjectID): string => {
+        return serviceId.toString();
+      }),
+    ).toEqual([SERVICE_ID_A.toString(), SERVICE_ID_B.toString()]);
+  });
+
+  test("the default config round-trips to itself", () => {
+    const config: MonitorStepSecurityEventsMonitor =
+      MonitorStepSecurityEventsMonitorUtil.getDefault();
+
+    const roundTripped: MonitorStepSecurityEventsMonitor =
+      MonitorStepSecurityEventsMonitorUtil.fromJSON(
+        MonitorStepSecurityEventsMonitorUtil.toJSON(config),
+      );
+
+    expect(roundTripped).toEqual(config);
+  });
+});