@oneuptime/common 12.0.17 → 12.0.19

package/Tests/Server/Utils/Runbook/RunbookExecutePermission.test.ts

@@ -0,0 +1,228 @@
+import {
+  RUNBOOK_ADVANCE_PERMISSIONS,
+  RUNBOOK_EXECUTE_PERMISSIONS,
+  assertCanAdvanceRunbookExecutions,
+  assertCanExecuteRunbooks,
+} from "../../../../Server/Utils/Runbook/RunbookExecutePermission";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+
+/*
+ * These are the pure authorization gates that stand in for RunbookExecution's
+ * create/update ACLs on the runbook-execution routes. The tests below pin the
+ * three things that are easy to regress by hand-editing the permission lists:
+ * that an allowed permission grants, that a BLOCK row never grants, and that a
+ * grant in one project never leaks into another.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID("60f7d9b0a1b2c3d4e5f60001");
+const OTHER_PROJECT_ID: ObjectID = new ObjectID("60f7d9b0a1b2c3d4e5f60002");
+
+function userPermission(
+  permission: Permission,
+  overrides?: Partial<UserPermission>,
+): UserPermission {
+  return {
+    _type: "UserPermission",
+    permission,
+    labelIds: [],
+    ...overrides,
+  };
+}
+
+function propsWith(
+  permissions: Array<UserPermission>,
+  projectId: ObjectID = PROJECT_ID,
+): DatabaseCommonInteractionProps {
+  const tenantPermission: UserTenantAccessPermission = {
+    _type: "UserTenantAccessPermission",
+    projectId,
+    permissions,
+  };
+
+  return {
+    userTenantAccessPermission: {
+      [projectId.toString()]: tenantPermission,
+    },
+  };
+}
+
+describe("RunbookExecutePermission", () => {
+  describe("permission list invariants", () => {
+    test("execute list contains RunbookExecution's create ACL roles", () => {
+      expect(RUNBOOK_EXECUTE_PERMISSIONS).toContain(Permission.ProjectOwner);
+      expect(RUNBOOK_EXECUTE_PERMISSIONS).toContain(Permission.ProjectAdmin);
+      expect(RUNBOOK_EXECUTE_PERMISSIONS).toContain(Permission.ProjectMember);
+      expect(RUNBOOK_EXECUTE_PERMISSIONS).toContain(
+        Permission.CreateRunbookExecution,
+      );
+      expect(RUNBOOK_EXECUTE_PERMISSIONS).toContain(Permission.RunbookAdmin);
+      expect(RUNBOOK_EXECUTE_PERMISSIONS).toContain(Permission.RunbookMember);
+    });
+
+    test("advance list is a strict superset of the execute list", () => {
+      for (const permission of RUNBOOK_EXECUTE_PERMISSIONS) {
+        expect(RUNBOOK_ADVANCE_PERMISSIONS).toContain(permission);
+      }
+      expect(RUNBOOK_ADVANCE_PERMISSIONS).toContain(
+        Permission.EditRunbookExecution,
+      );
+      expect(RUNBOOK_ADVANCE_PERMISSIONS.length).toBe(
+        RUNBOOK_EXECUTE_PERMISSIONS.length + 1,
+      );
+    });
+
+    test("EditRunbookExecution advances but does not start executions", () => {
+      // It is documented as the tick-off-without-starting permission.
+      expect(RUNBOOK_ADVANCE_PERMISSIONS).toContain(
+        Permission.EditRunbookExecution,
+      );
+      expect(RUNBOOK_EXECUTE_PERMISSIONS).not.toContain(
+        Permission.EditRunbookExecution,
+      );
+    });
+  });
+
+  describe("assertCanExecuteRunbooks", () => {
+    test.each(RUNBOOK_EXECUTE_PERMISSIONS)(
+      "grants when the user holds %s",
+      (permission: Permission) => {
+        const props: DatabaseCommonInteractionProps = propsWith([
+          userPermission(permission),
+        ]);
+
+        expect(() => {
+          return assertCanExecuteRunbooks(props, PROJECT_ID);
+        }).not.toThrow();
+      },
+    );
+
+    test("denies when the user holds no runbook permission", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([
+        userPermission(Permission.MonitorViewer),
+      ]);
+
+      expect(() => {
+        return assertCanExecuteRunbooks(props, PROJECT_ID);
+      }).toThrow(NotAuthorizedException);
+    });
+
+    test("denies when the only matching row is a block permission", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([
+        userPermission(Permission.ProjectOwner, { isBlockPermission: true }),
+      ]);
+
+      expect(() => {
+        return assertCanExecuteRunbooks(props, PROJECT_ID);
+      }).toThrow(NotAuthorizedException);
+    });
+
+    test("EditRunbookExecution alone cannot start an execution", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([
+        userPermission(Permission.EditRunbookExecution),
+      ]);
+
+      expect(() => {
+        return assertCanExecuteRunbooks(props, PROJECT_ID);
+      }).toThrow(NotAuthorizedException);
+    });
+
+    test("denies when there is no tenant access permission at all", () => {
+      expect(() => {
+        return assertCanExecuteRunbooks({}, PROJECT_ID);
+      }).toThrow(NotAuthorizedException);
+    });
+
+    test("denies when the permission set is empty", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([]);
+
+      expect(() => {
+        return assertCanExecuteRunbooks(props, PROJECT_ID);
+      }).toThrow(NotAuthorizedException);
+    });
+
+    test("a grant in another project does not leak into this one", () => {
+      // User is a ProjectOwner in OTHER_PROJECT_ID but not in PROJECT_ID.
+      const props: DatabaseCommonInteractionProps = propsWith(
+        [userPermission(Permission.ProjectOwner)],
+        OTHER_PROJECT_ID,
+      );
+
+      expect(() => {
+        return assertCanExecuteRunbooks(props, PROJECT_ID);
+      }).toThrow(NotAuthorizedException);
+    });
+
+    test("uses the start-runbook denial message", () => {
+      expect(() => {
+        return assertCanExecuteRunbooks(propsWith([]), PROJECT_ID);
+      }).toThrow("You do not have permission to start runbook executions");
+    });
+
+    test("an allow row still grants alongside an unrelated block row", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([
+        userPermission(Permission.MonitorViewer, { isBlockPermission: true }),
+        userPermission(Permission.RunbookMember),
+      ]);
+
+      expect(() => {
+        return assertCanExecuteRunbooks(props, PROJECT_ID);
+      }).not.toThrow();
+    });
+  });
+
+  describe("assertCanAdvanceRunbookExecutions", () => {
+    test("grants for EditRunbookExecution (advance-only permission)", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([
+        userPermission(Permission.EditRunbookExecution),
+      ]);
+
+      expect(() => {
+        return assertCanAdvanceRunbookExecutions(props, PROJECT_ID);
+      }).not.toThrow();
+    });
+
+    test("grants for a RunbookMember who could also start the run", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([
+        userPermission(Permission.RunbookMember),
+      ]);
+
+      expect(() => {
+        return assertCanAdvanceRunbookExecutions(props, PROJECT_ID);
+      }).not.toThrow();
+    });
+
+    test("denies when the user holds neither execute nor edit rights", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([
+        userPermission(Permission.MonitorViewer),
+      ]);
+
+      expect(() => {
+        return assertCanAdvanceRunbookExecutions(props, PROJECT_ID);
+      }).toThrow(NotAuthorizedException);
+    });
+
+    test("denies when the matching row is a block permission", () => {
+      const props: DatabaseCommonInteractionProps = propsWith([
+        userPermission(Permission.EditRunbookExecution, {
+          isBlockPermission: true,
+        }),
+      ]);
+
+      expect(() => {
+        return assertCanAdvanceRunbookExecutions(props, PROJECT_ID);
+      }).toThrow(NotAuthorizedException);
+    });
+
+    test("uses the change-runbook denial message", () => {
+      expect(() => {
+        return assertCanAdvanceRunbookExecutions(propsWith([]), PROJECT_ID);
+      }).toThrow("You do not have permission to change runbook executions");
+    });
+  });
+});

package/Tests/Server/Utils/SessionReplay/SessionReplayErasureTombstone.test.ts

@@ -0,0 +1,189 @@
+/*
+ * The erasure tombstone is the only thing that stops a session-replay chunk
+ * staged in Redis before a GDPR/CCPA erasure from being written back into
+ * ClickHouse after it. Its whole contract is "fail closed": a Redis blip must
+ * never be read as "not erased", and an erasure must never proceed without a
+ * tombstone the ingest path can later consult. These tests pin exactly that.
+ */
+
+jest.mock("../../../../Server/Infrastructure/Redis", () => {
+  return {
+    __esModule: true,
+    default: {
+      getClient: jest.fn(),
+      isConnected: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+    },
+  };
+});
+
+import Redis from "../../../../Server/Infrastructure/Redis";
+import {
+  ERASURE_TOMBSTONE_TTL_SECONDS,
+  ErasureTombstoneUnavailableError,
+  getErasedSessionsKey,
+  isSessionErased,
+  writeErasureTombstones,
+} from "../../../../Server/Utils/SessionReplay/SessionReplayErasureTombstone";
+
+const getClientMock: jest.Mock = Redis.getClient as unknown as jest.Mock;
+const isConnectedMock: jest.Mock = Redis.isConnected as unknown as jest.Mock;
+
+interface FakeClient {
+  sadd: jest.Mock;
+  expire: jest.Mock;
+  sismember: jest.Mock;
+}
+
+function connectedClient(overrides?: Partial<FakeClient>): FakeClient {
+  const client: FakeClient = {
+    sadd: jest.fn().mockResolvedValue(1),
+    expire: jest.fn().mockResolvedValue(1),
+    sismember: jest.fn().mockResolvedValue(0),
+    ...overrides,
+  };
+  getClientMock.mockReturnValue(client);
+  isConnectedMock.mockReturnValue(true);
+  return client;
+}
+
+function disconnected(): void {
+  getClientMock.mockReturnValue(null);
+  isConnectedMock.mockReturnValue(false);
+}
+
+describe("SessionReplayErasureTombstone", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe("getErasedSessionsKey", () => {
+    test("is namespaced per project", () => {
+      expect(getErasedSessionsKey("proj-1")).toBe("replay:erased:proj-1");
+      expect(getErasedSessionsKey("proj-2")).toBe("replay:erased:proj-2");
+      expect(getErasedSessionsKey("proj-1")).not.toBe(
+        getErasedSessionsKey("proj-2"),
+      );
+    });
+  });
+
+  describe("ERASURE_TOMBSTONE_TTL_SECONDS", () => {
+    test("is seven days", () => {
+      expect(ERASURE_TOMBSTONE_TTL_SECONDS).toBe(7 * 24 * 60 * 60);
+    });
+  });
+
+  describe("writeErasureTombstones", () => {
+    test("no-ops on an empty session list without touching Redis", async () => {
+      const client: FakeClient = connectedClient();
+
+      await writeErasureTombstones({ projectId: "p1", sessionIds: [] });
+
+      expect(client.sadd).not.toHaveBeenCalled();
+      expect(client.expire).not.toHaveBeenCalled();
+    });
+
+    test("adds the sessions to the per-project set and refreshes the TTL", async () => {
+      const client: FakeClient = connectedClient();
+
+      await writeErasureTombstones({
+        projectId: "p1",
+        sessionIds: ["s1", "s2"],
+      });
+
+      expect(client.sadd).toHaveBeenCalledWith("replay:erased:p1", [
+        "s1",
+        "s2",
+      ]);
+      expect(client.expire).toHaveBeenCalledWith(
+        "replay:erased:p1",
+        ERASURE_TOMBSTONE_TTL_SECONDS,
+      );
+    });
+
+    test("throws when Redis is unavailable so the erasure batch aborts", async () => {
+      disconnected();
+
+      await expect(
+        writeErasureTombstones({ projectId: "p1", sessionIds: ["s1"] }),
+      ).rejects.toThrow(/Redis is not connected/);
+    });
+
+    test("does not swallow a non-empty write when the client exists but is not connected", async () => {
+      getClientMock.mockReturnValue({
+        sadd: jest.fn(),
+        expire: jest.fn(),
+      });
+      isConnectedMock.mockReturnValue(false);
+
+      await expect(
+        writeErasureTombstones({ projectId: "p1", sessionIds: ["s1"] }),
+      ).rejects.toThrow(/refusing to erase/);
+    });
+  });
+
+  describe("isSessionErased", () => {
+    test("returns false for an empty session id without hitting Redis", async () => {
+      const client: FakeClient = connectedClient();
+
+      await expect(
+        isSessionErased({ projectId: "p1", sessionId: "" }),
+      ).resolves.toBe(false);
+      expect(client.sismember).not.toHaveBeenCalled();
+    });
+
+    test("returns true when the session is a member of the tombstone set", async () => {
+      const client: FakeClient = connectedClient({
+        sismember: jest.fn().mockResolvedValue(1),
+      });
+
+      await expect(
+        isSessionErased({ projectId: "p1", sessionId: "s1" }),
+      ).resolves.toBe(true);
+      expect(client.sismember).toHaveBeenCalledWith("replay:erased:p1", "s1");
+    });
+
+    test("returns false when the session is not in the tombstone set", async () => {
+      connectedClient({ sismember: jest.fn().mockResolvedValue(0) });
+
+      await expect(
+        isSessionErased({ projectId: "p1", sessionId: "s1" }),
+      ).resolves.toBe(false);
+    });
+
+    test("throws ErasureTombstoneUnavailableError when Redis is unavailable (never returns a boolean)", async () => {
+      disconnected();
+
+      await expect(
+        isSessionErased({ projectId: "p1", sessionId: "s1" }),
+      ).rejects.toBeInstanceOf(ErasureTombstoneUnavailableError);
+    });
+
+    test("throws ErasureTombstoneUnavailableError (not the raw error) when the lookup fails", async () => {
+      connectedClient({
+        sismember: jest.fn().mockRejectedValue(new Error("connection reset")),
+      });
+
+      const promise: Promise<boolean> = isSessionErased({
+        projectId: "p1",
+        sessionId: "s1",
+      });
+
+      await expect(promise).rejects.toBeInstanceOf(
+        ErasureTombstoneUnavailableError,
+      );
+      await expect(promise).rejects.toThrow(/connection reset/);
+    });
+  });
+});

package/Tests/Server/Utils/SessionReplay/SessionReplayUsage.test.ts

@@ -0,0 +1,205 @@
+import ObjectID from "../../../../Types/ObjectID";
+
+/*
+ * SessionReplayUsage owns the Redis key names and byte-budget read path shared
+ * by the ingest gate (which writes the counters) and the dashboard (which
+ * reads them). These tests pin two things that silently break the budget if
+ * they drift: the exact key format the two sides must agree on, and the
+ * read-path contract that "Redis unavailable" is reported as null (unknown)
+ * while "key absent" is reported as 0.
+ */
+
+jest.mock("../../../../Server/Infrastructure/Redis", () => {
+  return {
+    __esModule: true,
+    default: {
+      getClient: jest.fn(),
+      isConnected: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+    },
+  };
+});
+
+import Redis from "../../../../Server/Infrastructure/Redis";
+import SessionReplayUsage from "../../../../Server/Utils/SessionReplay/SessionReplayUsage";
+
+const getClientMock: jest.Mock = Redis.getClient as unknown as jest.Mock;
+const isConnectedMock: jest.Mock = Redis.isConnected as unknown as jest.Mock;
+
+const PROJECT_ID: ObjectID = new ObjectID("60f7d9b0a1b2c3d4e5f60001");
+const RUM_APP_ID: ObjectID = new ObjectID("60f7d9b0a1b2c3d4e5f60099");
+
+function mockConnectedClient(get: jest.Mock): void {
+  getClientMock.mockReturnValue({ get });
+  isConnectedMock.mockReturnValue(true);
+}
+
+describe("SessionReplayUsage", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe("UTC bucket helpers", () => {
+    test("getUtcDayBucket is a YYYY-MM-DD string", () => {
+      const bucket: string = SessionReplayUsage.getUtcDayBucket();
+      expect(bucket).toMatch(/^\d{4}-\d{2}-\d{2}$/);
+      // Same derivation the implementation promises: the UTC calendar day.
+      expect(bucket).toBe(new Date().toISOString().substring(0, 10));
+    });
+
+    test("getUtcMonthBucket is a YYYY-MM string and prefixes the day bucket", () => {
+      const month: string = SessionReplayUsage.getUtcMonthBucket();
+      expect(month).toMatch(/^\d{4}-\d{2}$/);
+      expect(month).toBe(new Date().toISOString().substring(0, 7));
+      // The day bucket always starts with the month bucket.
+      expect(SessionReplayUsage.getUtcDayBucket().startsWith(month)).toBe(true);
+    });
+  });
+
+  describe("key builders", () => {
+    test("daily project key embeds prefix, project id and today's UTC day", () => {
+      const key: string = SessionReplayUsage.getDailyProjectByteKey(PROJECT_ID);
+
+      expect(key).toBe(
+        `replay:rate:bytes:${PROJECT_ID.toString()}:${SessionReplayUsage.getUtcDayBucket()}`,
+      );
+    });
+
+    test("monthly application key embeds project id, rum app id and month", () => {
+      const key: string = SessionReplayUsage.getMonthlyApplicationByteKey({
+        projectId: PROJECT_ID,
+        rumApplicationId: RUM_APP_ID,
+      });
+
+      expect(key).toBe(
+        `replay:rate:bytes-month:${PROJECT_ID.toString()}:${RUM_APP_ID.toString()}:${SessionReplayUsage.getUtcMonthBucket()}`,
+      );
+    });
+
+    test("daily and monthly keys use distinct prefixes so they never collide", () => {
+      const daily: string =
+        SessionReplayUsage.getDailyProjectByteKey(PROJECT_ID);
+      const monthly: string = SessionReplayUsage.getMonthlyApplicationByteKey({
+        projectId: PROJECT_ID,
+        rumApplicationId: RUM_APP_ID,
+      });
+
+      expect(daily.startsWith("replay:rate:bytes:")).toBe(true);
+      expect(monthly.startsWith("replay:rate:bytes-month:")).toBe(true);
+      expect(daily).not.toEqual(monthly);
+    });
+
+    test("keys are project-scoped", () => {
+      const otherProject: ObjectID = new ObjectID("60f7d9b0a1b2c3d4e5f60002");
+      expect(SessionReplayUsage.getDailyProjectByteKey(PROJECT_ID)).not.toEqual(
+        SessionReplayUsage.getDailyProjectByteKey(otherProject),
+      );
+    });
+  });
+
+  describe("getProjectBytesUsedToday", () => {
+    test("returns null (unknown) when there is no Redis client", async () => {
+      getClientMock.mockReturnValue(null);
+      isConnectedMock.mockReturnValue(false);
+
+      await expect(
+        SessionReplayUsage.getProjectBytesUsedToday(PROJECT_ID),
+      ).resolves.toBeNull();
+    });
+
+    test("returns null (unknown) when Redis is not connected", async () => {
+      getClientMock.mockReturnValue({ get: jest.fn() });
+      isConnectedMock.mockReturnValue(false);
+
+      await expect(
+        SessionReplayUsage.getProjectBytesUsedToday(PROJECT_ID),
+      ).resolves.toBeNull();
+    });
+
+    test("returns 0 when the counter key is absent", async () => {
+      const get: jest.Mock = jest.fn().mockResolvedValue(null);
+      mockConnectedClient(get);
+
+      await expect(
+        SessionReplayUsage.getProjectBytesUsedToday(PROJECT_ID),
+      ).resolves.toBe(0);
+
+      expect(get).toHaveBeenCalledWith(
+        SessionReplayUsage.getDailyProjectByteKey(PROJECT_ID),
+      );
+    });
+
+    test("parses the stored decimal string into a number", async () => {
+      const get: jest.Mock = jest.fn().mockResolvedValue("2048");
+      mockConnectedClient(get);
+
+      await expect(
+        SessionReplayUsage.getProjectBytesUsedToday(PROJECT_ID),
+      ).resolves.toBe(2048);
+    });
+
+    test("treats a non-numeric stored value as 0 rather than NaN", async () => {
+      const get: jest.Mock = jest.fn().mockResolvedValue("not-a-number");
+      mockConnectedClient(get);
+
+      await expect(
+        SessionReplayUsage.getProjectBytesUsedToday(PROJECT_ID),
+      ).resolves.toBe(0);
+    });
+
+    test("returns null (unknown) when the Redis read throws", async () => {
+      const get: jest.Mock = jest
+        .fn()
+        .mockRejectedValue(new Error("connection reset"));
+      mockConnectedClient(get);
+
+      await expect(
+        SessionReplayUsage.getProjectBytesUsedToday(PROJECT_ID),
+      ).resolves.toBeNull();
+    });
+  });
+
+  describe("getApplicationBytesUsedThisMonth", () => {
+    test("reads the monthly application key", async () => {
+      const get: jest.Mock = jest.fn().mockResolvedValue("500");
+      mockConnectedClient(get);
+
+      const used: number | null =
+        await SessionReplayUsage.getApplicationBytesUsedThisMonth({
+          projectId: PROJECT_ID,
+          rumApplicationId: RUM_APP_ID,
+        });
+
+      expect(used).toBe(500);
+      expect(get).toHaveBeenCalledWith(
+        SessionReplayUsage.getMonthlyApplicationByteKey({
+          projectId: PROJECT_ID,
+          rumApplicationId: RUM_APP_ID,
+        }),
+      );
+    });
+
+    test("returns null (unknown) when Redis is unavailable", async () => {
+      getClientMock.mockReturnValue(null);
+      isConnectedMock.mockReturnValue(false);
+
+      await expect(
+        SessionReplayUsage.getApplicationBytesUsedThisMonth({
+          projectId: PROJECT_ID,
+          rumApplicationId: RUM_APP_ID,
+        }),
+      ).resolves.toBeNull();
+    });
+  });
+});