@oneuptime/common 12.0.16 → 12.0.18

package/Tests/App/Dashboard/SecurityEventsDetectionRulesPage.test.tsx

@@ -0,0 +1,250 @@
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { cleanup, render } from "@testing-library/react";
+import * as React from "react";
+import { MemoryRouter } from "react-router-dom";
+
+/*
+ * The Detection Rules page is one big ModelTable call, and everything this
+ * change added to it — the incident toggle, the two severity dropdowns
+ * with their showIf chains, the DB-default-mirroring initial values, and
+ * the "Create Monitor" row action — is configuration passed as props.
+ * Dropping any of it is type-safe and render-safe, so the props are the
+ * only place it can be pinned. The table itself is mocked to capture them;
+ * the showIf and onClick functions are then exercised directly.
+ */
+
+type CapturedFormField = {
+  field: Record<string, boolean>;
+  title: string;
+  showIf?: ((model: Record<string, unknown>) => boolean) | undefined;
+  dropdownModal?: { type: unknown } | undefined;
+};
+
+type CapturedActionButton = {
+  title: string;
+  disabled?: boolean | undefined;
+  tooltip?: string | undefined;
+  onClick: (
+    item: Record<string, unknown>,
+    onCompleteAction: () => void,
+    onError: (error: Error) => void,
+  ) => void;
+};
+
+type CapturedTableProps = {
+  formFields?: Array<CapturedFormField>;
+  actionButtons?: Array<CapturedActionButton>;
+  createInitialValues?: Record<string, unknown>;
+};
+
+let capturedTableProps: CapturedTableProps | null = null;
+
+jest.mock("../../../UI/Components/ModelTable/ModelTable", () => {
+  return {
+    __esModule: true,
+    default: (props: CapturedTableProps) => {
+      capturedTableProps = props;
+      return null;
+    },
+  };
+});
+
+import DetectionRulesPage from "../../../../App/FeatureSet/Dashboard/src/Pages/SecurityEvents/DetectionRules";
+import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
+import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
+import Project from "../../../Models/DatabaseModels/Project";
+import ProjectUtil from "../../../UI/Utils/Project";
+import Navigation from "../../../UI/Utils/Navigation";
+import PermissionGate, {
+  PermissionGateResult,
+} from "../../../UI/Utils/PermissionGate";
+import ObjectID from "../../../Types/ObjectID";
+import Route from "../../../Types/API/Route";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+
+function fieldTitled(title: string): CapturedFormField {
+  const field: CapturedFormField | undefined =
+    capturedTableProps?.formFields?.find(
+      (formField: CapturedFormField): boolean => {
+        return formField.title === title;
+      },
+    );
+
+  expect(field).toBeDefined();
+
+  return field!;
+}
+
+function renderPage(): void {
+  const project: Project = new Project();
+  project.id = PROJECT_ID;
+
+  render(
+    <MemoryRouter>
+      <DetectionRulesPage
+        pageRoute={new Route("/dashboard/security-events/detection-rules")}
+        currentProject={project}
+        hasPaymentMethod={true}
+      />
+    </MemoryRouter>,
+  );
+
+  expect(capturedTableProps).not.toBeNull();
+}
+
+function gateMonitorCreate(result: PermissionGateResult): void {
+  jest.spyOn(PermissionGate, "check").mockReturnValue(result);
+}
+
+describe("Detection Rules page", () => {
+  beforeEach(() => {
+    capturedTableProps = null;
+    jest.spyOn(ProjectUtil, "getCurrentProjectId").mockReturnValue(PROJECT_ID);
+    gateMonitorCreate({ isAllowed: true });
+  });
+
+  afterEach(() => {
+    cleanup();
+    jest.restoreAllMocks();
+  });
+
+  describe("incident opt-in fields", () => {
+    test("the incident toggle exists on the evaluation step", () => {
+      renderPage();
+      fieldTitled("Create Incident on Match");
+    });
+
+    test("the incident severity dropdown shows only when the toggle is on", () => {
+      renderPage();
+      const severityField: CapturedFormField = fieldTitled("Incident Severity");
+
+      expect(severityField.showIf).toBeDefined();
+      expect(severityField.showIf!({ shouldCreateIncident: true })).toBe(true);
+      expect(severityField.showIf!({ shouldCreateIncident: false })).toBe(
+        false,
+      );
+      // undefined must read as off — the column defaults to false.
+      expect(severityField.showIf!({})).toBe(false);
+    });
+
+    test("the incident severity dropdown selects from IncidentSeverity, not AlertSeverity", () => {
+      renderPage();
+      const severityField: CapturedFormField = fieldTitled("Incident Severity");
+
+      expect(severityField.dropdownModal?.type).toBe(IncidentSeverity);
+      expect(severityField.field).toEqual({ incidentSeverity: true });
+    });
+
+    test("the alert severity dropdown chains on the alert toggle the same way", () => {
+      renderPage();
+      const severityField: CapturedFormField = fieldTitled("Alert Severity");
+
+      expect(severityField.dropdownModal?.type).toBe(AlertSeverity);
+      expect(severityField.showIf!({ shouldCreateAlert: true })).toBe(true);
+      expect(severityField.showIf!({ shouldCreateAlert: false })).toBe(false);
+    });
+
+    test("initial values mirror the DB defaults, so the chained fields are honest on a fresh form", () => {
+      /*
+       * shouldCreateAlert defaults TRUE in the schema and
+       * shouldCreateIncident FALSE. Without these initial values a fresh
+       * create form shows the alert toggle apparently off (undefined)
+       * with its severity dropdown hidden — while saving would create an
+       * alerting rule.
+       */
+      renderPage();
+      expect(capturedTableProps?.createInitialValues).toMatchObject({
+        shouldCreateAlert: true,
+        shouldWriteDetectionFinding: true,
+        shouldCreateIncident: false,
+      });
+    });
+  });
+
+  describe("Create Monitor row action", () => {
+    test("navigates to monitor create carrying the rule id", () => {
+      renderPage();
+
+      const navigateSpy: ReturnType<typeof jest.spyOn> = jest
+        .spyOn(Navigation, "navigate")
+        .mockImplementation(() => {
+          return undefined;
+        });
+
+      const button: CapturedActionButton | undefined =
+        capturedTableProps?.actionButtons?.find(
+          (actionButton: CapturedActionButton): boolean => {
+            return actionButton.title === "Create Monitor";
+          },
+        );
+
+      expect(button).toBeDefined();
+
+      let completed: boolean = false;
+
+      button!.onClick(
+        { _id: "22222222-2222-4222-8222-222222222222" },
+        () => {
+          completed = true;
+        },
+        () => {
+          // no-op
+        },
+      );
+
+      expect(navigateSpy).toHaveBeenCalledTimes(1);
+
+      const destination: string = String(navigateSpy.mock.calls[0]?.[0]);
+
+      expect(destination).toContain("/monitors/create");
+      expect(destination).toContain(
+        "detectionRuleId=22222222-2222-4222-8222-222222222222",
+      );
+
+      // A row button that never completes spins forever.
+      expect(completed).toBe(true);
+    });
+
+    test("is enabled with the explainer tooltip when monitor create is allowed", () => {
+      renderPage();
+
+      const button: CapturedActionButton | undefined =
+        capturedTableProps?.actionButtons?.[0];
+
+      expect(button?.disabled).toBe(false);
+      expect(button?.tooltip).toContain("Detection Findings");
+    });
+
+    test("is disabled with the gate's reason when monitor create is not allowed", () => {
+      /*
+       * Same contract as MonitorTable's create button (issue #3306): a
+       * member who cannot create monitors must not be walked into the
+       * wizard to be refused at submit — the button stays visible,
+       * disabled, and says which permission is missing.
+       */
+      gateMonitorCreate({
+        isAllowed: false,
+        disabledReason: "You need the Create Monitor permission.",
+      });
+
+      renderPage();
+
+      const button: CapturedActionButton | undefined =
+        capturedTableProps?.actionButtons?.[0];
+
+      expect(button?.disabled).toBe(true);
+      expect(button?.tooltip).toBe("You need the Create Monitor permission.");
+    });
+  });
+});

package/Tests/App/Dashboard/SecurityEventsMonitorStepForm.test.tsx

@@ -0,0 +1,106 @@
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+import * as React from "react";
+import SecurityEventsMonitorStepForm from "../../../../App/FeatureSet/Dashboard/src/Components/Form/Monitor/SecurityEventsMonitor/SecurityEventsMonitorStepForm";
+import MonitorStepSecurityEventsMonitor, {
+  MonitorStepSecurityEventsMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepSecurityEventsMonitor";
+import AnalyticsModelAPI from "../../../UI/Utils/AnalyticsModelAPI/AnalyticsModelAPI";
+import ProjectUtil from "../../../UI/Utils/Project";
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * The step form's field gating IS the feature here: Event Class was moved
+ * out from behind the "Show Advanced Options" toggle so that watching
+ * Detection Findings — the single most useful class filter — no longer
+ * requires knowing the toggle exists. No other test renders this form
+ * (the view-model and type tests cover different layers), so without
+ * this one a refactor could quietly put the field back behind the toggle
+ * and nothing would fail.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+
+function renderForm(config?: Partial<MonitorStepSecurityEventsMonitor>): void {
+  render(
+    <SecurityEventsMonitorStepForm
+      monitorStepSecurityEventsMonitor={{
+        ...MonitorStepSecurityEventsMonitorUtil.getDefault(),
+        ...(config || {}),
+      }}
+      onMonitorStepSecurityEventsMonitorChanged={() => {
+        // no-op
+      }}
+      telemetryServices={[]}
+    />,
+  );
+}
+
+describe("SecurityEventsMonitorStepForm field gating", () => {
+  beforeEach(() => {
+    jest.spyOn(ProjectUtil, "getCurrentProjectId").mockReturnValue(PROJECT_ID);
+    // The live preview polls the event count; keep it quiet and offline.
+    jest.spyOn(AnalyticsModelAPI, "count").mockResolvedValue(0 as never);
+  });
+
+  afterEach(() => {
+    cleanup();
+    jest.restoreAllMocks();
+  });
+
+  test("Event Class is visible without opening advanced options", async () => {
+    renderForm();
+
+    // findBy: lets the preview's initial async count resolve inside act.
+    expect(await screen.findByText("Event Class")).toBeInTheDocument();
+    expect(screen.getByText("Show Advanced Options")).toBeInTheDocument();
+  });
+
+  test("severity, service and attribute filters stay behind the toggle", async () => {
+    renderForm();
+
+    await screen.findByText("Event Class");
+
+    expect(screen.queryByText("Event Severity")).not.toBeInTheDocument();
+    expect(
+      screen.queryByText("Filter by Telemetry Service"),
+    ).not.toBeInTheDocument();
+    expect(screen.queryByText("Filter by Attributes")).not.toBeInTheDocument();
+
+    fireEvent.click(screen.getByText("Show Advanced Options"));
+
+    expect(screen.getByText("Event Severity")).toBeInTheDocument();
+    expect(screen.getByText("Filter by Telemetry Service")).toBeInTheDocument();
+    expect(screen.getByText("Filter by Attributes")).toBeInTheDocument();
+  });
+
+  test("a stored severity filter still opens the advanced section by itself", async () => {
+    /*
+     * Editing a monitor whose config uses an advanced filter must show
+     * that filter immediately — the auto-open behaviour classNames used
+     * to share before it stopped being advanced.
+     */
+    renderForm({ severityNames: ["High" as never] });
+
+    expect(await screen.findByText("Event Severity")).toBeInTheDocument();
+    expect(screen.getByText("Hide Advanced Options")).toBeInTheDocument();
+  });
+
+  test("a stored class filter alone no longer forces the advanced section open", async () => {
+    renderForm({ classNames: ["Detection Finding"] });
+
+    expect(await screen.findByText("Event Class")).toBeInTheDocument();
+    expect(screen.queryByText("Event Severity")).not.toBeInTheDocument();
+    expect(screen.getByText("Show Advanced Options")).toBeInTheDocument();
+  });
+});

package/Tests/App/Dashboard/SecurityEventsMonitorsPage.test.tsx

@@ -0,0 +1,185 @@
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { cleanup, render, screen } from "@testing-library/react";
+import * as React from "react";
+import { MemoryRouter } from "react-router-dom";
+
+/*
+ * The Security Events → Monitors tab is a thin composition over
+ * MonitorTable, and the two things that make it correct are both props:
+ * the base query that scopes the table to MonitorType.SecurityEvents, and
+ * the replacement create button that deep-links into the gated monitor
+ * create page with the type preselected. Neither failing looks wrong on
+ * screen — an unscoped table just shows more rows, and a plain create
+ * button just asks the user to pick the type again — so the captured
+ * props are what gets pinned.
+ */
+
+type CapturedCardButton = {
+  title: string;
+  onClick: () => void;
+};
+
+type CapturedMonitorTableProps = {
+  query?: Record<string, unknown>;
+  disableCreate?: boolean;
+  cardButtons?: Array<CapturedCardButton>;
+  saveFilterProps?: { tableId?: string };
+  title?: string;
+};
+
+let capturedMonitorTableProps: CapturedMonitorTableProps | null = null;
+
+jest.mock(
+  "../../../../App/FeatureSet/Dashboard/src/Components/Monitor/MonitorTable",
+  () => {
+    return {
+      __esModule: true,
+      default: (props: CapturedMonitorTableProps) => {
+        capturedMonitorTableProps = props;
+        return null;
+      },
+    };
+  },
+);
+
+import SecurityEventsMonitorsPage from "../../../../App/FeatureSet/Dashboard/src/Pages/SecurityEvents/Monitors";
+import MonitorType from "../../../Types/Monitor/MonitorType";
+import Project from "../../../Models/DatabaseModels/Project";
+import Reseller from "../../../Models/DatabaseModels/Reseller";
+import ProjectUtil from "../../../UI/Utils/Project";
+import Navigation from "../../../UI/Utils/Navigation";
+import PermissionGate from "../../../UI/Utils/PermissionGate";
+import { CardButtonSchema } from "../../../UI/Components/Card/Card";
+import ObjectID from "../../../Types/ObjectID";
+import Route from "../../../Types/API/Route";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+
+function renderPage(project: Project): void {
+  render(
+    <MemoryRouter>
+      <SecurityEventsMonitorsPage
+        pageRoute={new Route("/dashboard/security-events/monitors")}
+        currentProject={project}
+        hasPaymentMethod={true}
+      />
+    </MemoryRouter>,
+  );
+}
+
+function buildProject(options: { telemetryDisabled?: boolean } = {}): Project {
+  const project: Project = new Project();
+  project.id = PROJECT_ID;
+
+  if (options.telemetryDisabled) {
+    const reseller: Reseller = new Reseller();
+    reseller.enableTelemetryFeatures = false;
+    project.reseller = reseller;
+  }
+
+  return project;
+}
+
+describe("Security Events monitors page", () => {
+  beforeEach(() => {
+    capturedMonitorTableProps = null;
+    jest.spyOn(ProjectUtil, "getCurrentProjectId").mockReturnValue(PROJECT_ID);
+    /*
+     * Pass the button through unchanged: what the PERMISSION gate does is
+     * PermissionGate's own test's problem; this page's contract is that
+     * the button it hands the gate deep-links correctly.
+     */
+    jest
+      .spyOn(PermissionGate, "gateCardButton")
+      .mockImplementation((button: CardButtonSchema) => {
+        return button;
+      });
+  });
+
+  afterEach(() => {
+    cleanup();
+    jest.restoreAllMocks();
+  });
+
+  test("scopes the table to Security Events monitors in this project", () => {
+    renderPage(buildProject());
+
+    expect(capturedMonitorTableProps).not.toBeNull();
+    expect(capturedMonitorTableProps?.query).toMatchObject({
+      monitorType: MonitorType.SecurityEvents,
+    });
+    expect(capturedMonitorTableProps?.query?.["projectId"]?.toString()).toBe(
+      PROJECT_ID.toString(),
+    );
+  });
+
+  test("keeps its filter state under its own table id", () => {
+    renderPage(buildProject());
+
+    expect(capturedMonitorTableProps?.saveFilterProps?.tableId).toBe(
+      "security-events-monitors-table",
+    );
+  });
+
+  test("replaces the built-in create with a type-preselecting deep link", () => {
+    renderPage(buildProject());
+
+    expect(capturedMonitorTableProps?.disableCreate).toBe(true);
+
+    const button: CapturedCardButton | undefined =
+      capturedMonitorTableProps?.cardButtons?.[0];
+
+    expect(button?.title).toBe("Create Security Events Monitor");
+
+    const navigateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(Navigation, "navigate")
+      .mockImplementation(() => {
+        return undefined;
+      });
+
+    button!.onClick();
+
+    const destination: string = String(navigateSpy.mock.calls[0]?.[0]);
+
+    expect(destination).toContain("/monitors/create");
+    /*
+     * Encoded, not raw: the enum value carries a space, which Route's
+     * character validator rejects — this exact assertion is what caught
+     * the crash the first time.
+     */
+    expect(destination).toContain(
+      `monitorType=${encodeURIComponent(MonitorType.SecurityEvents)}`,
+    );
+  });
+
+  test("drops the create button entirely when the permission gate says no", () => {
+    jest
+      .spyOn(PermissionGate, "gateCardButton")
+      .mockImplementation((): CardButtonSchema | null => {
+        return null;
+      });
+
+    renderPage(buildProject());
+
+    expect(capturedMonitorTableProps?.cardButtons).toEqual([]);
+  });
+
+  test("shows the reseller telemetry gate instead of the table", () => {
+    renderPage(buildProject({ telemetryDisabled: true }));
+
+    expect(capturedMonitorTableProps).toBeNull();
+    expect(
+      screen.getByText(/did not include telemetry features/i),
+    ).toBeInTheDocument();
+  });
+});