@oneuptime/common 12.0.18 → 12.0.20

package/Tests/App/Dashboard/MetricSeriesInvestigateMenu.test.tsx

@@ -0,0 +1,368 @@
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import {
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import * as React from "react";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+
+/*
+ * The per-series investigate menu is the chart's bridge from "this series
+ * is spiking" to the signals that explain it: the chip's magnifier must
+ * open a menu whose pivots carry the series' group-by labels as REAL
+ * filters (logs/traces URLs), whose "Filter to this series" narrows the
+ * live explorer view, and whose resource entry lands on the host page the
+ * series is about. Rendering the real MetricCharts (not a stub) pins the
+ * whole chain: series naming → chip → menu → scoped URL.
+ */
+
+/*
+ * ResponsiveContainer measures its parent, which is always 0x0 in jsdom,
+ * so the chart renders nothing without a fixed size.
+ */
+jest.mock("recharts", () => {
+  const actual: Record<string, any> = jest.requireActual("recharts") as Record<
+    string,
+    any
+  >;
+  return {
+    ...actual,
+    ResponsiveContainer: ({ children }: { children: React.ReactElement }) => {
+      return React.cloneElement(children, {
+        width: 600,
+        height: 300,
+      } as Record<string, unknown>);
+    },
+  };
+});
+
+const getListMock: MockFunction = getJestMockFunction();
+const fetchExemplarsMock: MockFunction = getJestMockFunction();
+const showToastMock: MockFunction = getJestMockFunction();
+
+/*
+ * The arrow wrappers are load bearing: jest.mock is hoisted above the
+ * compiled requires, so the mock variables above are still unassigned when
+ * the factory runs. Dereferencing them lazily, at call time, is what makes
+ * this work.
+ */
+jest.mock("../../../UI/Utils/ModelAPI/ModelAPI", () => {
+  return {
+    __esModule: true,
+    default: {
+      getList: (...args: Array<any>) => {
+        return getListMock(...args);
+      },
+    },
+  };
+});
+
+jest.mock("../../../UI/Components/Toast/ToastInit", () => {
+  return {
+    __esModule: true,
+    ShowToastNotification: (...args: Array<any>) => {
+      return showToastMock(...args);
+    },
+  };
+});
+
+/*
+ * Keep the exemplar fetch (fired by MetricCharts whenever the view has a
+ * resolvable window) off the network; everything else on the Metrics util
+ * surface that MetricCharts touches is pure enough to stub inline.
+ */
+jest.mock(
+  "../../../../App/FeatureSet/Dashboard/src/Components/Metrics/Utils/Metrics",
+  () => {
+    return {
+      __esModule: true,
+      default: {
+        fetchExemplars: (...args: Array<any>) => {
+          fetchExemplarsMock(...args);
+          /*
+           * Never resolves: a resolved exemplar set would setState after
+           * each test's assertions and trip React's act() warning; no
+           * test here cares about exemplar dots.
+           */
+          return new Promise(() => {
+            // Intentionally never settles.
+          });
+        },
+        setQueryTopNOverride: () => {
+          return undefined;
+        },
+        getQueryConfigTopNKey: (
+          _queryConfig: unknown,
+          index: number,
+          scope?: string,
+        ) => {
+          return `${scope || ""}:${index}`;
+        },
+        clearQueryTopNOverridesForScope: () => {
+          return undefined;
+        },
+        serializeAttributeFiltersForKey: (attributes: unknown) => {
+          return JSON.stringify(attributes || {});
+        },
+      },
+      DEFAULT_TOP_N_SERIES: 10,
+      SHOW_ALL_SERIES_TOP_N: 10_000,
+      sanitizeAttributeFilters: (attributes: unknown) => {
+        return attributes;
+      },
+    };
+  },
+);
+
+import MetricCharts from "../../../../App/FeatureSet/Dashboard/src/Components/Metrics/MetricCharts";
+import AggregatedResult from "../../../Types/BaseDatabase/AggregatedResult";
+import InBetween from "../../../Types/BaseDatabase/InBetween";
+import MetricsAggregationType from "../../../Types/Metrics/MetricsAggregationType";
+import MetricQueryConfigData from "../../../Types/Metrics/MetricQueryConfigData";
+import MetricViewData from "../../../Types/Metrics/MetricViewData";
+import ObjectID from "../../../Types/ObjectID";
+import Navigation from "../../../UI/Utils/Navigation";
+import ProjectUtil from "../../../UI/Utils/Project";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "77777777-1111-4111-8111-777777777777",
+);
+const HOST_MODEL_ID: string = "88888888-2222-4222-8222-888888888888";
+
+const WINDOW_START: Date = new Date("2026-08-20T10:00:00.000Z");
+const WINDOW_END: Date = new Date("2026-08-20T11:00:00.000Z");
+
+function buildQueryConfig(): MetricQueryConfigData {
+  return {
+    metricAliasData: { metricVariable: "a" },
+    metricQueryData: {
+      filterData: {
+        metricName: "cpu.usage",
+        attributes: {},
+        aggegationType: MetricsAggregationType.Avg,
+      },
+      groupByAttributeKeys: ["host.name"],
+    },
+  } as unknown as MetricQueryConfigData;
+}
+
+function buildViewData(): MetricViewData {
+  return {
+    queryConfigs: [buildQueryConfig()],
+    formulaConfigs: [],
+    startAndEndDate: new InBetween<Date>(WINDOW_START, WINDOW_END),
+  } as MetricViewData;
+}
+
+function buildResults(): Array<AggregatedResult> {
+  const timestamps: Array<string> = [
+    "2026-08-20T10:10:00.000Z",
+    "2026-08-20T10:20:00.000Z",
+  ];
+  const data: Array<Record<string, unknown>> = [];
+  for (const host of ["web-01", "web-02"]) {
+    for (const [index, timestamp] of timestamps.entries()) {
+      data.push({
+        timestamp: new Date(timestamp),
+        value: host === "web-01" ? 90 + index : 10 + index,
+        attributes: { "host.name": host },
+      });
+    }
+  }
+  return [{ data, truncated: false } as unknown as AggregatedResult];
+}
+
+let navigateSpy: ReturnType<typeof jest.spyOn>;
+
+beforeEach(() => {
+  getListMock.mockReset();
+  fetchExemplarsMock.mockReset();
+  showToastMock.mockReset();
+  navigateSpy = jest.spyOn(Navigation, "navigate").mockImplementation(() => {
+    return undefined;
+  });
+  jest.spyOn(ProjectUtil, "getCurrentProjectId").mockReturnValue(PROJECT_ID);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  cleanup();
+});
+
+function getNavigatedUrl(): string {
+  const lastCall: Array<unknown> | undefined =
+    navigateSpy.mock.calls[navigateSpy.mock.calls.length - 1];
+  return decodeURIComponent(String(lastCall?.[0]));
+}
+
+describe("per-series investigate menu", () => {
+  test("each series chip carries an investigate button that opens the menu", () => {
+    render(
+      <MetricCharts
+        metricViewData={buildViewData()}
+        metricResults={buildResults()}
+        metricTypes={[]}
+      />,
+    );
+
+    fireEvent.click(screen.getByLabelText("Investigate host.name=web-01"));
+
+    const menu: HTMLElement = screen.getByRole("menu", {
+      name: "Series investigation actions",
+    });
+    expect(menu).toBeInTheDocument();
+    expect(screen.getByText("View logs")).toBeInTheDocument();
+    expect(screen.getByText("View traces")).toBeInTheDocument();
+    expect(screen.getByText("View exceptions")).toBeInTheDocument();
+    // The menu header names the series and what it is scoped to.
+    expect(menu.textContent).toContain("host.name = web-01");
+  });
+
+  test("read-only hosts get an explorer deep link; read-write hosts filter in place", () => {
+    const onQueryConfigsChange: MockFunction = getJestMockFunction();
+
+    const { unmount } = render(
+      <MetricCharts
+        metricViewData={buildViewData()}
+        metricResults={buildResults()}
+        metricTypes={[]}
+      />,
+    );
+
+    fireEvent.click(screen.getByLabelText("Investigate host.name=web-01"));
+    expect(screen.getByText("Open in Metric Explorer")).toBeInTheDocument();
+    expect(screen.queryByText("Filter to this series")).toBeNull();
+    unmount();
+
+    render(
+      <MetricCharts
+        metricViewData={buildViewData()}
+        metricResults={buildResults()}
+        metricTypes={[]}
+        onQueryConfigsChange={(...args: Array<any>) => {
+          onQueryConfigsChange(...args);
+        }}
+      />,
+    );
+
+    fireEvent.click(screen.getByLabelText("Investigate host.name=web-01"));
+    expect(screen.queryByText("Open in Metric Explorer")).toBeNull();
+
+    fireEvent.click(screen.getByText("Filter to this series"));
+
+    expect(onQueryConfigsChange).toHaveBeenCalledTimes(1);
+    const narrowedConfigs: Array<MetricQueryConfigData> = onQueryConfigsChange
+      .mock.calls[0]?.[0] as Array<MetricQueryConfigData>;
+    expect(
+      (
+        narrowedConfigs[0]?.metricQueryData.filterData as Record<
+          string,
+          unknown
+        >
+      )["attributes"],
+    ).toEqual({ "host.name": "web-01" });
+  });
+
+  test("View logs navigates to the logs explorer scoped to the series and window", async () => {
+    render(
+      <MetricCharts
+        metricViewData={buildViewData()}
+        metricResults={buildResults()}
+        metricTypes={[]}
+      />,
+    );
+
+    fireEvent.click(screen.getByLabelText("Investigate host.name=web-02"));
+    fireEvent.click(screen.getByText("View logs"));
+
+    await waitFor(() => {
+      expect(navigateSpy).toHaveBeenCalled();
+    });
+
+    const url: string = getNavigatedUrl();
+    expect(url).toContain("/logs");
+    expect(url).toContain('["attributes.host.name",["web-02"]]');
+    expect(url).toContain("range=Custom");
+    expect(url).toContain("start=");
+    expect(url).toContain("end=");
+  });
+
+  test("View exceptions reports what the exceptions grammar cannot carry", async () => {
+    render(
+      <MetricCharts
+        metricViewData={buildViewData()}
+        metricResults={buildResults()}
+        metricTypes={[]}
+      />,
+    );
+
+    fireEvent.click(screen.getByLabelText("Investigate host.name=web-01"));
+    fireEvent.click(screen.getByText("View exceptions"));
+
+    await waitFor(() => {
+      expect(navigateSpy).toHaveBeenCalled();
+    });
+
+    const url: string = getNavigatedUrl();
+    expect(url).toContain("/exceptions");
+    expect(url).toContain("status=all");
+    // The host.name narrowing has no exceptions facet — the user is told.
+    expect(showToastMock).toHaveBeenCalled();
+  });
+
+  test("the host series jumps to the matching Host page", async () => {
+    getListMock.mockReturnValue(
+      Promise.resolve({ data: [{ _id: HOST_MODEL_ID }] }),
+    );
+
+    render(
+      <MetricCharts
+        metricViewData={buildViewData()}
+        metricResults={buildResults()}
+        metricTypes={[]}
+      />,
+    );
+
+    fireEvent.click(screen.getByLabelText("Investigate host.name=web-01"));
+    fireEvent.click(screen.getByText('Open host "web-01"'));
+
+    await waitFor(() => {
+      expect(navigateSpy).toHaveBeenCalled();
+    });
+
+    const listArgs: Record<string, unknown> = getListMock.mock
+      .calls[0]?.[0] as Record<string, unknown>;
+    expect(listArgs["query"]).toEqual({
+      projectId: PROJECT_ID,
+      hostIdentifier: "web-01",
+    });
+    expect(getNavigatedUrl()).toContain(`/host/${HOST_MODEL_ID}`);
+  });
+
+  test("enableSeriesActions={false} renders plain chips with no investigate affordance", () => {
+    render(
+      <MetricCharts
+        metricViewData={buildViewData()}
+        metricResults={buildResults()}
+        metricTypes={[]}
+        enableSeriesActions={false}
+      />,
+    );
+
+    // The chips themselves still render…
+    expect(screen.getByText("host.name=web-01")).toBeInTheDocument();
+    // …but nothing offers navigation.
+    expect(screen.queryByLabelText("Investigate host.name=web-01")).toBeNull();
+  });
+});

package/Tests/App/Dashboard/OnCallPreventionGuards.test.tsx

@@ -122,14 +122,18 @@ import CallMethods from "../../../../App/FeatureSet/Dashboard/src/Components/Not
 import PushMethods from "../../../../App/FeatureSet/Dashboard/src/Components/NotificationMethods/Push";
 import WhatsAppMethods from "../../../../App/FeatureSet/Dashboard/src/Components/NotificationMethods/WhatsApp";
 import TelegramMethods from "../../../../App/FeatureSet/Dashboard/src/Components/NotificationMethods/Telegram";
+import SlackMethods from "../../../../App/FeatureSet/Dashboard/src/Components/NotificationMethods/Slack";
+import MicrosoftTeamsMethods from "../../../../App/FeatureSet/Dashboard/src/Components/NotificationMethods/MicrosoftTeams";
 import WebhookMethods from "../../../../App/FeatureSet/Dashboard/src/Components/NotificationMethods/Webhook";
 import BaseModel, {
   DatabaseBaseModelType,
 } from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import UserCall from "../../../Models/DatabaseModels/UserCall";
 import UserEmail from "../../../Models/DatabaseModels/UserEmail";
+import UserMicrosoftTeams from "../../../Models/DatabaseModels/UserMicrosoftTeams";
 import UserNotificationRule from "../../../Models/DatabaseModels/UserNotificationRule";
 import UserPush from "../../../Models/DatabaseModels/UserPush";
+import UserSlack from "../../../Models/DatabaseModels/UserSlack";
 import UserSMS from "../../../Models/DatabaseModels/UserSMS";
 import UserTelegram from "../../../Models/DatabaseModels/UserTelegram";
 import UserWebhook from "../../../Models/DatabaseModels/UserWebhook";
@@ -1470,7 +1474,7 @@ describe("Escalation rules, wired: the delete confirmation says what it costs",
 
 /*
  * ---------------------------------------------------------------------------
- * THE SEVEN METHOD TABLES, RENDERED FOR REAL.
+ * THE NINE METHOD TABLES, RENDERED FOR REAL.
  * ---------------------------------------------------------------------------
  *
  * This block exists because the first cut of this feature shipped a correct,
@@ -1532,6 +1536,8 @@ const METHOD_ID_CALL: string = "33333333-9999-4999-8999-999999999999";
 const METHOD_ID_PUSH: string = "44444444-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
 const METHOD_ID_WHATSAPP: string = "55555555-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
 const METHOD_ID_TELEGRAM: string = "66666666-cccc-4ccc-8ccc-cccccccccccc";
+const METHOD_ID_SLACK: string = "88888888-eeee-4eee-8eee-eeeeeeeeeeee";
+const METHOD_ID_TEAMS: string = "99999999-ffff-4fff-8fff-ffffffffffff";
 const METHOD_ID_WEBHOOK: string = "77777777-dddd-4ddd-8ddd-dddddddddddd";
 
 const METHOD_SURFACES: Array<MethodSurface> = [
@@ -1624,6 +1630,36 @@ const METHOD_SURFACES: Array<MethodSurface> = [
     modalTitle: "Delete Telegram Account",
     methodLabel: "Telegram: @alexchen",
   },
+  {
+    name: "Slack",
+    Component: SlackMethods,
+    modelType: UserSlack,
+    relationName: "userSlack",
+    methodId: METHOD_ID_SLACK,
+    buildRow: (): BaseModel => {
+      return buildMethodRow(UserSlack, METHOD_ID_SLACK, {
+        slackUserName: "alexchen",
+        isVerified: true,
+      });
+    },
+    modalTitle: "Delete Slack Account",
+    methodLabel: "Slack: alexchen",
+  },
+  {
+    name: "Microsoft Teams",
+    Component: MicrosoftTeamsMethods,
+    modelType: UserMicrosoftTeams,
+    relationName: "userMicrosoftTeams",
+    methodId: METHOD_ID_TEAMS,
+    buildRow: (): BaseModel => {
+      return buildMethodRow(UserMicrosoftTeams, METHOD_ID_TEAMS, {
+        microsoftTeamsUserName: "Alex Example",
+        isVerified: true,
+      });
+    },
+    modalTitle: "Delete Microsoft Teams Account",
+    methodLabel: "Microsoft Teams: Alex Example",
+  },
   {
     name: "Webhook",
     Component: WebhookMethods,

package/Tests/App/Dashboard/OnCallRulesTable.test.tsx

@@ -38,7 +38,7 @@ import getJestMockFunction, { MockFunction } from "../../MockType";
  *
  * The fourth is where the "Notification Method" dropdown comes from, which is
  * now two different places depending on whose rules are on screen. For the
- * signed-in user it is still seven reads of the seven method models, and that
+ * signed-in user it is still nine reads of the nine method models, and that
  * path is the four settings pages every existing user relies on. For anybody
  * else those reads are REFUSED - the models are scoped to the person who owns
  * the device, because the columns behind them are the raw phone number, the
@@ -186,8 +186,10 @@ import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
 import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
 import UserCall from "../../../Models/DatabaseModels/UserCall";
 import UserEmail from "../../../Models/DatabaseModels/UserEmail";
+import UserMicrosoftTeams from "../../../Models/DatabaseModels/UserMicrosoftTeams";
 import UserNotificationRule from "../../../Models/DatabaseModels/UserNotificationRule";
 import UserPush from "../../../Models/DatabaseModels/UserPush";
+import UserSlack from "../../../Models/DatabaseModels/UserSlack";
 import UserSMS from "../../../Models/DatabaseModels/UserSMS";
 import UserTelegram from "../../../Models/DatabaseModels/UserTelegram";
 import UserWebhook from "../../../Models/DatabaseModels/UserWebhook";
@@ -199,7 +201,7 @@ import ObjectID from "../../../Types/ObjectID";
 import ProjectUtil from "../../../UI/Utils/Project";
 
 /*
- * The seven models whose rows only their owner may read. They are listed
+ * The nine models whose rows only their owner may read. They are listed
  * together because the assertion that matters is about the SET: an admin
  * surface that reads any one of them is reading a row it is not entitled to,
  * and which one hardly matters.
@@ -211,13 +213,15 @@ const NOTIFICATION_METHOD_MODELS: Array<unknown> = [
   UserPush,
   UserWhatsApp,
   UserTelegram,
+  UserSlack,
+  UserMicrosoftTeams,
   UserWebhook,
 ];
 
 /*
  * What the admin surface hands over in place of those reads: a channel name, the
  * id of the row, and a mask. Telegram is unverified on purpose - the self-serve
- * path filters `isVerified: true` in six of its seven queries, so a supplied
+ * path filters `isVerified: true` in eight of its nine queries, so a supplied
  * list that offered unverified methods would be the two paths disagreeing about
  * what is pickable.
  */
@@ -250,6 +254,8 @@ const METHOD_FOREIGN_KEYS: Array<keyof UserNotificationRule> = [
   "userPushId",
   "userWhatsAppId",
   "userTelegramId",
+  "userSlackId",
+  "userMicrosoftTeamsId",
   "userWebhookId",
 ];
 
@@ -343,7 +349,7 @@ const getMethodOptions: GetMethodOptions = (
 };
 
 /*
- * The seven RELATION spellings. Selecting any of these on a rule pulls columns
+ * The nine RELATION spellings. Selecting any of these on a rule pulls columns
  * out of the method models themselves - the raw address, the raw number, the
  * telegram handle - through a table an administrator is allowed to read.
  *
@@ -366,6 +372,8 @@ const METHOD_RELATIONS: Array<string> = [
   "userPush",
   "userWhatsApp",
   "userTelegram",
+  "userSlack",
+  "userMicrosoftTeams",
   "userWebhook",
 ];
 
@@ -719,7 +727,7 @@ describe("OnCallRulesTable", () => {
 
     /*
      * The whole point of the redesign, in one assertion. Not "reads them and
-     * shows fewer columns" - does not read them. Each of these seven models is
+     * shows fewer columns" - does not read them. Each of these nine models is
      * scoped to the person who owns the device, and the columns behind them are
      * the raw phone number, the webhook bearer url, the push device token, the
      * telegram chat id and the verification code. A request here is a request
@@ -748,7 +756,7 @@ describe("OnCallRulesTable", () => {
      * The readiness payload the admin page sources these from is fetched
      * asynchronously and can fail outright, so an absent list is a real state
      * rather than a caller mistake. Treating it as "then fetch them yourself"
-     * would fire seven refused requests and turn this component's error state on
+     * would fire nine refused requests and turn this component's error state on
      * - taking the rule repair away because a DIFFERENT read failed.
      */
     await renderForOtherUser(undefined);
@@ -786,7 +794,7 @@ describe("OnCallRulesTable", () => {
 
     /*
      * The unverified Telegram method is absent, which mirrors the
-     * `isVerified: true` filter on six of the seven self-serve queries. A rule
+     * `isVerified: true` filter on eight of the nine self-serve queries. A rule
      * pointed at an unverified device is a rule that pages nothing.
      */
     expect(
@@ -805,7 +813,7 @@ describe("OnCallRulesTable", () => {
       });
 
     /*
-     * The seven foreign keys are mutually exclusive and nothing validates that
+     * The nine foreign keys are mutually exclusive and nothing validates that
      * client-side, so this asserts the whole set: an SMS id written to
      * `userEmailId` would page an address rather than a phone, and would not
      * error anywhere on the way.
@@ -968,7 +976,7 @@ describe("OnCallRulesTable", () => {
   test("the signed-in user's own table still reads the method models itself", async () => {
     /*
      * The regression surface. Four settings pages every existing user already
-     * relies on read their own seven models to fill this dropdown, and reading
+     * relies on read their own nine models to fill this dropdown, and reading
      * your own rows is exactly what those models allow. Nothing about the admin
      * surface is a reason to change it - and an unmasked label is more use to
      * somebody looking at their own phone number than a mask of it.
@@ -985,7 +993,7 @@ describe("OnCallRulesTable", () => {
       getQueriedUserIds().filter((userId: string | undefined) => {
         return userId === CURRENT_USER_ID_STRING;
       }),
-    ).toHaveLength(7);
+    ).toHaveLength(9);
 
     expect(getMethodOptions(capturedTables[0]!)).toEqual([
       { label: `Email: ${OWN_EMAIL_ADDRESS}`, value: OWN_EMAIL_ID },

package/Tests/Models/DatabaseModels/DomainRoleTierCoverage.test.ts

@@ -117,6 +117,30 @@ const NOT_READABLE_BY_THEIR_DOMAIN_ROLES: Array<string> = [
   "IncomingCallPolicyEscalationRule",
 ];
 
+/*
+ * Columns inside an in-domain table whose read list deliberately stops short of
+ * the domain's full tier set, and why. The table-level list above is about
+ * whole tables a role holder is kept out of; this is the same idea one level
+ * down, for a table they are otherwise welcome in.
+ *
+ * Entries are the exact `<table>.<column> is missing <tier>` strings the sweep
+ * produces, so the list is self-policing: widen one of these read lists again
+ * and the entry stops being produced and the assertion fails.
+ *
+ * https://github.com/OneUptime/oneuptime/issues/3360 - Monitor's three secret
+ * keys are bearer credentials, not monitor data. Reading one is gated on being
+ * able to ROTATE it, which is what separates MonitorMember (may edit a monitor,
+ * so may see and reset its key) from MonitorViewer (read-only, so may not).
+ * Viewer used to be on these lists, which made "read-only" mean "can read a
+ * live credential for every agent in the project" -- the same reasoning that
+ * keeps MonitorSecret out of the table list above.
+ */
+const COLUMNS_NOT_READABLE_BY_THEIR_DOMAIN_ROLES: Array<string> = [
+  "Monitor.incomingEmailSecretKey is missing MonitorViewer",
+  "Monitor.incomingRequestSecretKey is missing MonitorViewer",
+  "Monitor.serverMonitorSecretKey is missing MonitorViewer",
+];
+
 type ModelNameFunction = (modelType: ModelType) => string;
 
 const modelName: ModelNameFunction = (modelType: ModelType): string => {
@@ -317,7 +341,9 @@ describe("Domain role tier coverage", () => {
       }
     }
 
-    expect(missing.sort()).toEqual([]);
+    expect(missing.sort()).toEqual(
+      COLUMNS_NOT_READABLE_BY_THEIR_DOMAIN_ROLES.slice().sort(),
+    );
     expect(checked).toBeGreaterThan(500);
   });
 });