@oneuptime/common 12.0.15 → 12.0.17

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsClient.test.ts

@@ -0,0 +1,308 @@
+import { generateKeyPairSync } from "crypto";
+import jwt from "jsonwebtoken";
+import GoogleSecOpsClient, {
+  FetchLike,
+  FetchResponseLike,
+} from "../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient";
+import APIException from "../../../../Types/Exception/ApiException";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../../Types/JSON";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The SecOps client is the trust boundary between customer-supplied
+ * connection config and outbound Google API calls. These tests pin the
+ * request construction end-to-end against an injected fetch — the
+ * JWT-bearer token exchange (a real RS256 signature, verified by
+ * decoding), the Bearer-authenticated alerts call, token caching — and
+ * the tolerant response parsing that keeps tenant-shape drift from
+ * turning into dropped alerts.
+ */
+
+const { privateKey } = generateKeyPairSync("rsa", {
+  modulusLength: 2048,
+  privateKeyEncoding: { type: "pkcs8", format: "pem" },
+  publicKeyEncoding: { type: "spki", format: "pem" },
+});
+
+const SERVICE_ACCOUNT_JSON: string = JSON.stringify({
+  client_email: "poller@example.iam.gserviceaccount.com",
+  private_key: privateKey,
+  token_uri: "https://oauth2.example.com/token",
+});
+
+const INSTANCE: string =
+  "projects/my-project/locations/us/instances/3f0a-instance";
+
+interface RecordedRequest {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+  body?: string | undefined;
+}
+
+function makeFetch(responses: Array<{ status: number; body: string }>): {
+  fetchImplementation: FetchLike;
+  requests: Array<RecordedRequest>;
+} {
+  const requests: Array<RecordedRequest> = [];
+  let callIndex: number = 0;
+
+  const fetchImplementation: FetchLike = (
+    url: string,
+    init: {
+      method: string;
+      headers: Record<string, string>;
+      body?: string | undefined;
+    },
+  ): Promise<FetchResponseLike> => {
+    requests.push({
+      url,
+      method: init.method,
+      headers: init.headers,
+      body: init.body,
+    });
+
+    const response: { status: number; body: string } =
+      responses[Math.min(callIndex, responses.length - 1)]!;
+    callIndex++;
+
+    return Promise.resolve({
+      ok: response.status >= 200 && response.status < 300,
+      status: response.status,
+      text: (): Promise<string> => {
+        return Promise.resolve(response.body);
+      },
+    });
+  };
+
+  return { fetchImplementation, requests };
+}
+
+function tokenResponse(): { status: number; body: string } {
+  return {
+    status: 200,
+    body: JSON.stringify({ access_token: "test-token", expires_in: 3600 }),
+  };
+}
+
+describe("GoogleSecOpsClient validation", () => {
+  test("accepts real region prefixes and rejects garbage", () => {
+    expect(() => {
+      return GoogleSecOpsClient.validateRegion("us");
+    }).not.toThrow();
+    expect(() => {
+      return GoogleSecOpsClient.validateRegion("europe");
+    }).not.toThrow();
+
+    for (const bad of ["", "US", "us_", "us/../etc", "us east"]) {
+      expect(() => {
+        return GoogleSecOpsClient.validateRegion(bad);
+      }).toThrow(BadDataException);
+    }
+  });
+
+  test("accepts the documented instance resource name shape only", () => {
+    expect(() => {
+      return GoogleSecOpsClient.validateInstanceResourceName(INSTANCE);
+    }).not.toThrow();
+
+    for (const bad of [
+      "",
+      "instances/abc",
+      "projects/p/instances/i",
+      "projects/p/locations/l/instances/i/extra",
+    ]) {
+      expect(() => {
+        return GoogleSecOpsClient.validateInstanceResourceName(bad);
+      }).toThrow(BadDataException);
+    }
+  });
+
+  test("parseServiceAccountJson requires client_email and private_key, defaults token_uri", () => {
+    expect(() => {
+      return GoogleSecOpsClient.parseServiceAccountJson("not json");
+    }).toThrow(BadDataException);
+
+    expect(() => {
+      return GoogleSecOpsClient.parseServiceAccountJson(
+        JSON.stringify({ client_email: "a@b.c" }),
+      );
+    }).toThrow(BadDataException);
+
+    const withoutTokenUri: string = JSON.stringify({
+      client_email: "a@b.c",
+      private_key: privateKey,
+    });
+
+    expect(
+      GoogleSecOpsClient.parseServiceAccountJson(withoutTokenUri).tokenUri,
+    ).toBe("https://oauth2.googleapis.com/token");
+  });
+});
+
+describe("GoogleSecOpsClient.extractAlerts", () => {
+  test("accepts a bare array, filtering non-objects", () => {
+    expect(
+      GoogleSecOpsClient.extractAlerts([{ id: "a" }, "junk", 4, null]),
+    ).toEqual([{ id: "a" }]);
+  });
+
+  test("accepts alerts and detections envelopes", () => {
+    expect(GoogleSecOpsClient.extractAlerts({ alerts: [{ id: "a" }] })).toEqual(
+      [{ id: "a" }],
+    );
+    expect(
+      GoogleSecOpsClient.extractAlerts({ detections: [{ id: "d" }] }),
+    ).toEqual([{ id: "d" }]);
+  });
+
+  test("returns [] for shapes it does not recognize instead of guessing", () => {
+    expect(GoogleSecOpsClient.extractAlerts({ nope: true })).toEqual([]);
+    expect(GoogleSecOpsClient.extractAlerts("junk")).toEqual([]);
+    expect(GoogleSecOpsClient.extractAlerts(null)).toEqual([]);
+  });
+});
+
+describe("GoogleSecOpsClient.fetchDetectionAlerts", () => {
+  function makeClient(responses: Array<{ status: number; body: string }>): {
+    client: GoogleSecOpsClient;
+    requests: Array<RecordedRequest>;
+  } {
+    const { fetchImplementation, requests } = makeFetch(responses);
+
+    const client: GoogleSecOpsClient = new GoogleSecOpsClient({
+      region: "us",
+      instanceResourceName: INSTANCE,
+      serviceAccountJson: SERVICE_ACCOUNT_JSON,
+      fetchImplementation,
+    });
+
+    return { client, requests };
+  }
+
+  test("exchanges a signed JWT assertion for a token, then calls the alerts view with Bearer auth", async () => {
+    const { client, requests } = makeClient([
+      tokenResponse(),
+      { status: 200, body: JSON.stringify({ alerts: [{ id: "a-1" }] }) },
+    ]);
+
+    const alerts: Array<JSONObject> = await client.fetchDetectionAlerts({
+      startTime: new Date("2026-08-21T09:00:00.000Z"),
+      endTime: new Date("2026-08-21T10:00:00.000Z"),
+    });
+
+    expect(alerts).toEqual([{ id: "a-1" }]);
+    expect(requests).toHaveLength(2);
+
+    // Token exchange: form-encoded JWT-bearer grant against token_uri.
+    const tokenRequest: RecordedRequest = requests[0]!;
+    expect(tokenRequest.url).toBe("https://oauth2.example.com/token");
+    expect(tokenRequest.method).toBe("POST");
+    expect(tokenRequest.headers["Content-Type"]).toBe(
+      "application/x-www-form-urlencoded",
+    );
+
+    const params: URLSearchParams = new URLSearchParams(
+      tokenRequest.body || "",
+    );
+    expect(params.get("grant_type")).toBe(
+      "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    );
+
+    const assertion: JSONObject = jwt.decode(
+      params.get("assertion") || "",
+    ) as JSONObject;
+    expect(assertion["iss"]).toBe("poller@example.iam.gserviceaccount.com");
+    expect(assertion["aud"]).toBe("https://oauth2.example.com/token");
+    expect(assertion["scope"]).toBe(
+      "https://www.googleapis.com/auth/cloud-platform",
+    );
+
+    // Alerts call: regional base URL, instance path, window params, Bearer.
+    const alertsRequest: RecordedRequest = requests[1]!;
+    expect(alertsRequest.url).toContain(
+      `https://us-chronicle.googleapis.com/v1alpha/${INSTANCE}/legacy:legacyFetchAlertsView?`,
+    );
+    expect(alertsRequest.url).toContain(
+      encodeURIComponent("2026-08-21T09:00:00.000Z"),
+    );
+    expect(alertsRequest.headers["Authorization"]).toBe("Bearer test-token");
+  });
+
+  test("caches the access token across calls", async () => {
+    const { client, requests } = makeClient([
+      tokenResponse(),
+      { status: 200, body: JSON.stringify({ alerts: [] }) },
+      { status: 200, body: JSON.stringify({ alerts: [] }) },
+    ]);
+
+    await client.fetchDetectionAlerts({
+      startTime: new Date("2026-08-21T09:00:00.000Z"),
+      endTime: new Date("2026-08-21T10:00:00.000Z"),
+    });
+    await client.fetchDetectionAlerts({
+      startTime: new Date("2026-08-21T10:00:00.000Z"),
+      endTime: new Date("2026-08-21T11:00:00.000Z"),
+    });
+
+    const tokenCalls: Array<RecordedRequest> = requests.filter(
+      (request: RecordedRequest): boolean => {
+        return request.url === "https://oauth2.example.com/token";
+      },
+    );
+
+    expect(tokenCalls).toHaveLength(1);
+  });
+
+  test("non-2xx token exchange and alerts responses throw APIException with the body snippet", async () => {
+    const failingToken: { client: GoogleSecOpsClient } = makeClient([
+      { status: 403, body: "permission denied" },
+    ]);
+
+    await expect(
+      failingToken.client.fetchDetectionAlerts({
+        startTime: new Date("2026-08-21T09:00:00.000Z"),
+        endTime: new Date("2026-08-21T10:00:00.000Z"),
+      }),
+    ).rejects.toThrow(APIException);
+
+    const failingAlerts: { client: GoogleSecOpsClient } = makeClient([
+      tokenResponse(),
+      { status: 500, body: "backend exploded" },
+    ]);
+
+    await expect(
+      failingAlerts.client.fetchDetectionAlerts({
+        startTime: new Date("2026-08-21T09:00:00.000Z"),
+        endTime: new Date("2026-08-21T10:00:00.000Z"),
+      }),
+    ).rejects.toThrow(/backend exploded/);
+  });
+
+  test("constructor rejects bad region/instance/credentials up front", () => {
+    expect(() => {
+      return new GoogleSecOpsClient({
+        region: "not a region",
+        instanceResourceName: INSTANCE,
+        serviceAccountJson: SERVICE_ACCOUNT_JSON,
+      });
+    }).toThrow(BadDataException);
+
+    expect(() => {
+      return new GoogleSecOpsClient({
+        region: "us",
+        instanceResourceName: "nope",
+        serviceAccountJson: SERVICE_ACCOUNT_JSON,
+      });
+    }).toThrow(BadDataException);
+
+    expect(() => {
+      return new GoogleSecOpsClient({
+        region: "us",
+        instanceResourceName: INSTANCE,
+        serviceAccountJson: "{}",
+      });
+    }).toThrow(BadDataException);
+  });
+});

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsPoller.test.ts

@@ -0,0 +1,271 @@
+import GoogleSecOpsConnection from "../../../../Models/DatabaseModels/GoogleSecOpsConnection";
+import GoogleSecOpsConnectionService from "../../../../Server/Services/GoogleSecOpsConnectionService";
+import OTelIngestService, {
+  TelemetryServiceMetadata,
+} from "../../../../Server/Services/OpenTelemetryIngestService";
+import SecurityEventService from "../../../../Server/Services/SecurityEventService";
+import GoogleSecOpsClient from "../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient";
+import GoogleSecOpsPoller from "../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller";
+import ServiceType from "../../../../Types/Telemetry/ServiceType";
+import ObjectID from "../../../../Types/ObjectID";
+import { JSONObject } from "../../../../Types/JSON";
+import { getJestSpyOn } from "../../../Spy";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * The poller is the managed half of the Google SecOps connector: it turns
+ * customer connections into Detection Finding rows on a cursor. These
+ * tests pin the cursor-window arithmetic (overlap, stale-cursor cap), the
+ * normalization hand-off, and the error bookkeeping — the behaviors that
+ * decide whether alerts get lost, duplicated, or silently stop flowing.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const CONNECTION_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+
+function makeConnection(): GoogleSecOpsConnection {
+  const connection: GoogleSecOpsConnection = new GoogleSecOpsConnection();
+  connection._id = CONNECTION_ID.toString();
+  connection.projectId = PROJECT_ID;
+  connection.name = "Prod tenant";
+  connection.region = "us";
+  connection.instanceResourceName =
+    "projects/p/locations/us/instances/instance-1";
+  connection.serviceAccountJson = "{}"; // never parsed — client is injected.
+  connection.pollIntervalInMinutes = 5;
+  return connection;
+}
+
+function makeServiceMetadata(): TelemetryServiceMetadata {
+  return {
+    serviceName: "Google SecOps",
+    primaryEntityId: new ObjectID("33333333-3333-4333-8333-333333333333"),
+    primaryEntityType: ServiceType.OpenTelemetry,
+    dataRententionInDays: 15,
+    serviceRetentionConfig: null,
+    serviceRetentionInDays: null,
+    projectRetentionConfig: null,
+    projectRetentionInDays: 15,
+  };
+}
+
+function makeFakeClient(alerts: Array<JSONObject>): {
+  client: GoogleSecOpsClient;
+  calls: Array<{ startTime: Date; endTime: Date }>;
+} {
+  const calls: Array<{ startTime: Date; endTime: Date }> = [];
+
+  const client: GoogleSecOpsClient = {
+    fetchDetectionAlerts: (data: {
+      startTime: Date;
+      endTime: Date;
+    }): Promise<Array<JSONObject>> => {
+      calls.push({ startTime: data.startTime, endTime: data.endTime });
+      return Promise.resolve(alerts);
+    },
+  } as unknown as GoogleSecOpsClient;
+
+  return { client, calls };
+}
+
+describe("GoogleSecOpsPoller.pollConnection", () => {
+  let insertedRows: Array<JSONObject>;
+
+  beforeEach(() => {
+    insertedRows = [];
+
+    getJestSpyOn(
+      OTelIngestService,
+      "telemetryServiceFromName",
+    ).mockResolvedValue(makeServiceMetadata() as never);
+
+    getJestSpyOn(SecurityEventService, "insertJsonRows").mockImplementation(((
+      rows: Array<JSONObject>,
+    ): Promise<void> => {
+      insertedRows.push(...rows);
+      return Promise.resolve();
+    }) as never);
+
+    getJestSpyOn(
+      GoogleSecOpsConnectionService,
+      "updateOneById",
+    ).mockResolvedValue(undefined as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("ingests fetched alerts as Detection Finding rows and advances the cursor", async () => {
+    const connection: GoogleSecOpsConnection = makeConnection();
+    const { client } = makeFakeClient([
+      {
+        id: "alert-1",
+        detection: [{ ruleName: "Brute force", severity: "HIGH" }],
+      },
+    ]);
+
+    const ingested: number = await GoogleSecOpsPoller.pollConnection(
+      connection,
+      client,
+    );
+
+    expect(ingested).toBe(1);
+    expect(insertedRows).toHaveLength(1);
+    expect(insertedRows[0]!["classUid"]).toBe(2004);
+    expect(insertedRows[0]!["className"]).toBe("Detection Finding");
+    expect(insertedRows[0]!["ruleName"]).toBe("Brute force");
+    expect(insertedRows[0]!["projectId"]).toBe(PROJECT_ID.toString());
+
+    expect(GoogleSecOpsConnectionService.updateOneById).toHaveBeenCalledTimes(
+      1,
+    );
+    const updateArgs: JSONObject = (
+      GoogleSecOpsConnectionService.updateOneById as unknown as jest.Mock
+    ).mock.calls[0]![0] as JSONObject;
+    const updateData: JSONObject = updateArgs["data"] as JSONObject;
+    expect(typeof updateData["cursor"]).toBe("string");
+    expect(updateData["lastError"]).toBeNull();
+  });
+
+  test("first poll (no cursor) looks back the default window; cursor polls overlap by a minute", async () => {
+    const connection: GoogleSecOpsConnection = makeConnection();
+    const { client, calls } = makeFakeClient([]);
+
+    await GoogleSecOpsPoller.pollConnection(connection, client);
+
+    expect(calls).toHaveLength(1);
+    const firstWindowMinutes: number =
+      (calls[0]!.endTime.getTime() - calls[0]!.startTime.getTime()) /
+      (60 * 1000);
+    expect(Math.round(firstWindowMinutes)).toBe(15);
+
+    /*
+     * Second poll with a cursor five minutes ago: window starts one
+     * overlap-minute before the cursor.
+     */
+    const cursorDate: Date = new Date(Date.now() - 5 * 60 * 1000);
+    connection.cursor = cursorDate.toISOString();
+
+    await GoogleSecOpsPoller.pollConnection(connection, client);
+
+    expect(calls).toHaveLength(2);
+    const overlapMs: number =
+      cursorDate.getTime() - calls[1]!.startTime.getTime();
+    expect(Math.round(overlapMs / (60 * 1000))).toBe(1);
+  });
+
+  test("a stale cursor is capped at the maximum lookback", async () => {
+    const connection: GoogleSecOpsConnection = makeConnection();
+    connection.cursor = new Date(
+      Date.now() - 7 * 24 * 60 * 60 * 1000,
+    ).toISOString();
+
+    const { client, calls } = makeFakeClient([]);
+
+    await GoogleSecOpsPoller.pollConnection(connection, client);
+
+    const windowMinutes: number =
+      (calls[0]!.endTime.getTime() - calls[0]!.startTime.getTime()) /
+      (60 * 1000);
+    expect(Math.round(windowMinutes)).toBe(24 * 60);
+  });
+
+  test("an unparseable alert is skipped without failing the batch", async () => {
+    const connection: GoogleSecOpsConnection = makeConnection();
+
+    /*
+     * The normalizer is tolerant by design, so simulate a poison alert by
+     * making the first normalization throw via a hostile getter.
+     */
+    const poison: JSONObject = {};
+    Object.defineProperty(poison, "detection", {
+      get: (): never => {
+        throw new Error("poison alert");
+      },
+      enumerable: true,
+    });
+
+    const { client } = makeFakeClient([
+      poison,
+      { id: "ok", detection: [{ ruleName: "Fine", severity: "LOW" }] },
+    ]);
+
+    const ingested: number = await GoogleSecOpsPoller.pollConnection(
+      connection,
+      client,
+    );
+
+    expect(ingested).toBe(1);
+    expect(insertedRows).toHaveLength(1);
+    expect(insertedRows[0]!["ruleName"]).toBe("Fine");
+  });
+
+  test("no alerts: no service resolution, no insert, cursor still advances", async () => {
+    const connection: GoogleSecOpsConnection = makeConnection();
+    const { client } = makeFakeClient([]);
+
+    const ingested: number = await GoogleSecOpsPoller.pollConnection(
+      connection,
+      client,
+    );
+
+    expect(ingested).toBe(0);
+    expect(OTelIngestService.telemetryServiceFromName).not.toHaveBeenCalled();
+    expect(SecurityEventService.insertJsonRows).not.toHaveBeenCalled();
+    expect(GoogleSecOpsConnectionService.updateOneById).toHaveBeenCalledTimes(
+      1,
+    );
+  });
+});
+
+describe("GoogleSecOpsPoller.pollAllDueConnections", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("polls due connections, skips not-yet-due ones, and records lastError on failure", async () => {
+    const dueConnection: GoogleSecOpsConnection = makeConnection();
+
+    const notDueConnection: GoogleSecOpsConnection = makeConnection();
+    notDueConnection._id = "44444444-4444-4444-8444-444444444444";
+    notDueConnection.lastPolledAt = new Date();
+
+    getJestSpyOn(GoogleSecOpsConnectionService, "findBy").mockResolvedValue([
+      dueConnection,
+      notDueConnection,
+    ] as never);
+
+    const updateSpy: ReturnType<typeof getJestSpyOn> = getJestSpyOn(
+      GoogleSecOpsConnectionService,
+      "updateOneById",
+    ).mockResolvedValue(undefined as never);
+
+    const pollSpy: ReturnType<typeof getJestSpyOn> = getJestSpyOn(
+      GoogleSecOpsPoller,
+      "pollConnection",
+    ).mockRejectedValue(new Error("token exchange failed") as never);
+
+    await GoogleSecOpsPoller.pollAllDueConnections();
+
+    // Only the due connection was polled...
+    expect(pollSpy).toHaveBeenCalledTimes(1);
+
+    // ...and its failure was recorded as lastError.
+    expect(updateSpy).toHaveBeenCalledTimes(1);
+    const updateArgs: JSONObject = updateSpy.mock.calls[0]![0] as JSONObject;
+    const updateData: JSONObject = updateArgs["data"] as JSONObject;
+    expect(updateData["lastError"]).toContain("token exchange failed");
+  });
+});