@oneuptime/common 12.0.18 → 12.0.20

package/Tests/Server/Utils/Workspace/MicrosoftTeamsDirectMessage.test.ts

@@ -0,0 +1,454 @@
+import { describe, expect, test, afterEach, beforeEach } from "@jest/globals";
+
+/*
+ * Tests for the Microsoft Teams DIRECT MESSAGE path —
+ * MicrosoftTeamsUtil.sendDirectMessageToUserAsBot, the sender behind the
+ * "Microsoft Teams" user notification method.
+ *
+ * The problem it solves, and the reason it exists next to the older
+ * sendDirectMessageToUser: WorkspaceUserAuthToken stores the user's Microsoft
+ * ENTRA OBJECT ID, but the Graph-based helper posts to /chats/{chatId} and so
+ * needs a CHAT id — the two id spaces never meet. This method resolves a
+ * deliverable conversation from the Entra id instead, two ways:
+ *
+ *   1. REUSE. A personal chat previously captured from a bot activity (whose
+ *      roster contained this Entra id) is known-deliverable and carries the
+ *      regional serviceUrl, so it is preferred and delivered through the
+ *      existing sendAdaptiveCardToChat path.
+ *
+ *   2. CREATE. Otherwise Bot Framework createConversation is asked to resolve
+ *      (or create) the 1:1 conversation from the member's Entra id — which
+ *      works exactly when the OneUptime app is installed for that user, so
+ *      Microsoft's opaque roster rejection is translated into "install the
+ *      OneUptime app" before anybody reads it off an on-call timeline.
+ */
+
+jest.mock("../../../../Server/EnvironmentConfig", () => {
+  return {
+    ...(jest.requireActual("../../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >),
+    MicrosoftTeamsAppClientId: "11111111-2222-3333-4444-555555555555",
+    MicrosoftTeamsAppClientSecret: "test-secret",
+    MicrosoftTeamsAppTenantId: "test-tenant",
+  };
+});
+
+jest.mock("botbuilder", () => {
+  return {
+    CloudAdapter: class CloudAdapter {},
+    ConfigurationBotFrameworkAuthentication: class ConfigurationBotFrameworkAuthentication {},
+    TeamsActivityHandler: class TeamsActivityHandler {},
+    TurnContext: class TurnContext {},
+    ActivityHandler: class ActivityHandler {},
+    MessageFactory: {
+      text: jest.fn(),
+      attachment: jest.fn((attachment: unknown) => {
+        return { type: "message", attachments: [attachment] };
+      }),
+    },
+    CardFactory: { heroCard: jest.fn() },
+    TeamsInfo: {
+      getMembers: jest.fn(),
+      getPagedMembers: jest.fn(),
+    },
+  };
+});
+
+import MicrosoftTeamsUtil from "../../../../Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
+import WorkspaceProjectAuthTokenService from "../../../../Server/Services/WorkspaceProjectAuthTokenService";
+import WorkspaceProjectAuthToken, {
+  MicrosoftTeamsChat,
+  MicrosoftTeamsMiscData,
+} from "../../../../Models/DatabaseModels/WorkspaceProjectAuthToken";
+import logger from "../../../../Server/Utils/Logger";
+import ObjectID from "../../../../Types/ObjectID";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import {
+  WorkspaceMessageBlock,
+  WorkspacePayloadMarkdown,
+} from "../../../../Types/Workspace/WorkspaceMessagePayload";
+import type { ConversationParameters, TurnContext } from "botbuilder";
+
+const MOCK_APP_CLIENT_ID: string = "11111111-2222-3333-4444-555555555555";
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const TENANT_ID: string = "tenant-xyz";
+const ENTRA_OBJECT_ID: string = "e6f1c1f7-aad0-4b6c-9c11-2f5b7c8d9e0f";
+const PERSONAL_CHAT_ID: string = "a:1personalchat";
+const DEFAULT_SERVICE_URL: string = "https://smba.trafficmanager.net/teams/";
+const REGIONAL_SERVICE_URL: string = "https://smba.emea.teams.microsoft.com/";
+const ROSTER_ERROR_TEXT: string =
+  "The bot is not part of the conversation roster.";
+
+function markdownBlocks(): Array<WorkspaceMessageBlock> {
+  const block: WorkspacePayloadMarkdown = {
+    _type: "WorkspacePayloadMarkdown",
+    text: "**incident** page body",
+  };
+  return [block];
+}
+
+function personalChat(
+  overrides: Partial<MicrosoftTeamsChat> = {},
+): MicrosoftTeamsChat {
+  return {
+    id: PERSONAL_CHAT_ID,
+    name: "Alice Example",
+    chatType: "personal",
+    serviceUrl: REGIONAL_SERVICE_URL,
+    memberAadObjectIds: [ENTRA_OBJECT_ID],
+    ...overrides,
+  } as MicrosoftTeamsChat;
+}
+
+function miscData(
+  overrides: Partial<MicrosoftTeamsMiscData> = {},
+): MicrosoftTeamsMiscData {
+  return {
+    tenantId: TENANT_ID,
+    teamId: "team-1",
+    teamName: "Engineering",
+    botId: "bot-1",
+    ...overrides,
+  } as MicrosoftTeamsMiscData;
+}
+
+function mockProjectAuth(
+  overrides: Partial<MicrosoftTeamsMiscData> = {},
+): jest.SpyInstance {
+  return jest
+    .spyOn(WorkspaceProjectAuthTokenService, "getProjectAuth")
+    .mockResolvedValue({
+      id: PROJECT_ID,
+      workspaceProjectId: TENANT_ID,
+      miscData: miscData(overrides),
+    } as unknown as WorkspaceProjectAuthToken as never);
+}
+
+interface FakeCreateAdapter {
+  createConversationAsync: jest.Mock;
+  capturedParams: Array<ConversationParameters>;
+  capturedServiceUrls: Array<string>;
+  sentActivities: Array<unknown>;
+}
+
+function installFakeCreateAdapter(options?: {
+  createError?: unknown;
+}): FakeCreateAdapter {
+  const capturedParams: Array<ConversationParameters> = [];
+  const capturedServiceUrls: Array<string> = [];
+  const sentActivities: Array<unknown> = [];
+
+  const createConversationAsync: jest.Mock = jest.fn(
+    async (
+      _appId: string,
+      _channelId: string,
+      serviceUrl: string,
+      _audience: string,
+      conversationParameters: ConversationParameters,
+      logic: (context: TurnContext) => Promise<void>,
+    ): Promise<void> => {
+      capturedServiceUrls.push(serviceUrl);
+      capturedParams.push(conversationParameters);
+
+      if (options && "createError" in options) {
+        throw options.createError;
+      }
+
+      const fakeContext: TurnContext = {
+        sendActivity: async (activity: unknown): Promise<unknown> => {
+          sentActivities.push(activity);
+          return { id: "msg-123" };
+        },
+      } as unknown as TurnContext;
+
+      await logic(fakeContext);
+    },
+  );
+
+  jest
+    .spyOn(MicrosoftTeamsUtil as any, "getBotAdapter")
+    .mockReturnValue({ createConversationAsync: createConversationAsync });
+
+  return {
+    createConversationAsync: createConversationAsync,
+    capturedParams: capturedParams,
+    capturedServiceUrls: capturedServiceUrls,
+    sentActivities: sentActivities,
+  };
+}
+
+describe("MicrosoftTeamsUtil.sendDirectMessageToUserAsBot", () => {
+  let sendToChat: jest.SpyInstance;
+
+  beforeEach(() => {
+    jest.spyOn(logger, "error").mockImplementation((): void => {
+      return undefined;
+    });
+    jest.spyOn(logger, "debug").mockImplementation((): void => {
+      return undefined;
+    });
+
+    sendToChat = jest
+      .spyOn(MicrosoftTeamsUtil, "sendAdaptiveCardToChat")
+      .mockResolvedValue({
+        channel: {
+          id: PERSONAL_CHAT_ID,
+          name: "Alice Example",
+          workspaceType: "MicrosoftTeams",
+        },
+        threadId: "msg-1",
+      } as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * (A) Reusing a captured personal chat.
+   * -----------------------------------------------------------------------
+   */
+
+  describe("reusing a captured personal chat", () => {
+    test("a personal chat whose roster carries the Entra id is delivered through sendAdaptiveCardToChat", async () => {
+      mockProjectAuth({
+        availableChats: { [PERSONAL_CHAT_ID]: personalChat() },
+      });
+      const adapter: FakeCreateAdapter = installFakeCreateAdapter();
+
+      await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+        projectId: PROJECT_ID,
+        workspaceUserId: ENTRA_OBJECT_ID,
+        messageBlocks: markdownBlocks(),
+      });
+
+      expect(sendToChat).toHaveBeenCalledTimes(1);
+      const arg: { chatId: string; projectId: ObjectID } = sendToChat.mock
+        .calls[0][0] as { chatId: string; projectId: ObjectID };
+      expect(arg.chatId).toBe(PERSONAL_CHAT_ID);
+      expect(arg.projectId.toString()).toBe(PROJECT_ID.toString());
+
+      // The Bot Framework create path is not touched at all.
+      expect(adapter.createConversationAsync).not.toHaveBeenCalled();
+    });
+
+    test("a personal chat belonging to somebody ELSE is not reused", async () => {
+      mockProjectAuth({
+        availableChats: {
+          [PERSONAL_CHAT_ID]: personalChat({
+            memberAadObjectIds: ["some-other-user"],
+          }),
+        },
+      });
+      installFakeCreateAdapter();
+
+      await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+        projectId: PROJECT_ID,
+        workspaceUserId: ENTRA_OBJECT_ID,
+        messageBlocks: markdownBlocks(),
+      });
+
+      expect(sendToChat).not.toHaveBeenCalled();
+    });
+
+    test("a GROUP chat carrying the Entra id is not reused - a page is a direct message, not a group post", async () => {
+      mockProjectAuth({
+        availableChats: {
+          [PERSONAL_CHAT_ID]: personalChat({ chatType: "groupChat" }),
+        },
+      });
+      installFakeCreateAdapter();
+
+      await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+        projectId: PROJECT_ID,
+        workspaceUserId: ENTRA_OBJECT_ID,
+        messageBlocks: markdownBlocks(),
+      });
+
+      expect(sendToChat).not.toHaveBeenCalled();
+    });
+
+    test("a legacy personal chat with NO captured roster is not matched (absent means unknown, not mine)", async () => {
+      mockProjectAuth({
+        availableChats: {
+          [PERSONAL_CHAT_ID]: personalChat({ memberAadObjectIds: undefined }),
+        },
+      });
+      installFakeCreateAdapter();
+
+      await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+        projectId: PROJECT_ID,
+        workspaceUserId: ENTRA_OBJECT_ID,
+        messageBlocks: markdownBlocks(),
+      });
+
+      expect(sendToChat).not.toHaveBeenCalled();
+    });
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * (B) Creating the conversation from the Entra id.
+   * -----------------------------------------------------------------------
+   */
+
+  describe("creating the 1:1 conversation via Bot Framework", () => {
+    test("createConversation is asked for a non-group conversation with the member's Entra id and the tenant", async () => {
+      mockProjectAuth();
+      const adapter: FakeCreateAdapter = installFakeCreateAdapter();
+
+      await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+        projectId: PROJECT_ID,
+        workspaceUserId: ENTRA_OBJECT_ID,
+        messageBlocks: markdownBlocks(),
+      });
+
+      expect(adapter.createConversationAsync).toHaveBeenCalledTimes(1);
+      const params: ConversationParameters = adapter
+        .capturedParams[0] as ConversationParameters;
+      expect(params.isGroup).toBe(false);
+      expect(params.members?.[0]?.id).toBe(ENTRA_OBJECT_ID);
+      expect(params.tenantId).toBe(TENANT_ID);
+      expect((params.channelData as { tenant: { id: string } }).tenant.id).toBe(
+        TENANT_ID,
+      );
+      // 28:<appId> is the Teams-side bot account id.
+      expect(params.bot?.id).toBe(`28:${MOCK_APP_CLIENT_ID}`);
+    });
+
+    test("the adaptive card is sent inside the created conversation", async () => {
+      mockProjectAuth();
+      const adapter: FakeCreateAdapter = installFakeCreateAdapter();
+
+      await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+        projectId: PROJECT_ID,
+        workspaceUserId: ENTRA_OBJECT_ID,
+        messageBlocks: markdownBlocks(),
+      });
+
+      expect(adapter.sentActivities).toHaveLength(1);
+      const activity: { attachments: Array<{ contentType: string }> } = adapter
+        .sentActivities[0] as { attachments: Array<{ contentType: string }> };
+      expect(activity.attachments[0]?.contentType).toBe(
+        "application/vnd.microsoft.card.adaptive",
+      );
+    });
+
+    test("falls back to the commercial-cloud serviceUrl when nothing regional was ever captured", async () => {
+      mockProjectAuth();
+      const adapter: FakeCreateAdapter = installFakeCreateAdapter();
+
+      await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+        projectId: PROJECT_ID,
+        workspaceUserId: ENTRA_OBJECT_ID,
+        messageBlocks: markdownBlocks(),
+      });
+
+      expect(adapter.capturedServiceUrls[0]).toBe(DEFAULT_SERVICE_URL);
+    });
+
+    test("prefers a regional serviceUrl captured on ANY chat (required for GCC/DoD)", async () => {
+      mockProjectAuth({
+        availableChats: {
+          "a:someoneelse": personalChat({
+            id: "a:someoneelse",
+            memberAadObjectIds: ["some-other-user"],
+            serviceUrl: REGIONAL_SERVICE_URL,
+          }),
+        },
+      });
+      const adapter: FakeCreateAdapter = installFakeCreateAdapter();
+
+      await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+        projectId: PROJECT_ID,
+        workspaceUserId: ENTRA_OBJECT_ID,
+        messageBlocks: markdownBlocks(),
+      });
+
+      expect(adapter.capturedServiceUrls[0]).toBe(REGIONAL_SERVICE_URL);
+    });
+  });
+
+  /*
+   * ----------------------------------------------------------------------- *
+   * (C) Failure translation and refusals.
+   * -----------------------------------------------------------------------
+   */
+
+  describe("failure translation and refusals", () => {
+    test("Microsoft's roster rejection becomes 'install the OneUptime app', the one fix that works", async () => {
+      mockProjectAuth();
+      installFakeCreateAdapter({
+        createError: new Error(ROSTER_ERROR_TEXT),
+      });
+
+      await expect(
+        MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+          projectId: PROJECT_ID,
+          workspaceUserId: ENTRA_OBJECT_ID,
+          messageBlocks: markdownBlocks(),
+        }),
+      ).rejects.toThrow(
+        "The OneUptime app is not installed for this Microsoft Teams user. Ask them to add the OneUptime app in Microsoft Teams (personal scope) so the bot can message them directly.",
+      );
+    });
+
+    test("every other Bot Framework error passes through untouched", async () => {
+      mockProjectAuth();
+      installFakeCreateAdapter({
+        createError: new Error("throttled: too many requests"),
+      });
+
+      await expect(
+        MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+          projectId: PROJECT_ID,
+          workspaceUserId: ENTRA_OBJECT_ID,
+          messageBlocks: markdownBlocks(),
+        }),
+      ).rejects.toThrow("throttled: too many requests");
+    });
+
+    test("a project with no Teams integration is refused before the Bot Framework is touched", async () => {
+      jest
+        .spyOn(WorkspaceProjectAuthTokenService, "getProjectAuth")
+        .mockResolvedValue(null as never);
+      const adapter: FakeCreateAdapter = installFakeCreateAdapter();
+
+      await expect(
+        MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+          projectId: PROJECT_ID,
+          workspaceUserId: ENTRA_OBJECT_ID,
+          messageBlocks: markdownBlocks(),
+        }),
+      ).rejects.toThrow(
+        "Microsoft Teams integration not found for this project",
+      );
+
+      expect(adapter.createConversationAsync).not.toHaveBeenCalled();
+    });
+
+    test("a project auth row with no tenant id is refused", async () => {
+      jest
+        .spyOn(WorkspaceProjectAuthTokenService, "getProjectAuth")
+        .mockResolvedValue({
+          id: PROJECT_ID,
+          workspaceProjectId: undefined,
+          miscData: miscData(),
+        } as unknown as WorkspaceProjectAuthToken as never);
+      installFakeCreateAdapter();
+
+      await expect(
+        MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+          projectId: PROJECT_ID,
+          workspaceUserId: ENTRA_OBJECT_ID,
+          messageBlocks: markdownBlocks(),
+        }),
+      ).rejects.toThrow(BadDataException);
+    });
+  });
+});

package/Tests/Server/Views/AnalyticsConsentPartial.test.ts

@@ -0,0 +1,241 @@
+import { describe, expect, test } from "@jest/globals";
+import ejs from "ejs";
+import fs from "fs";
+import path from "path";
+
+/*
+ * Consent and attribution have to behave the same on every origin that loads
+ * the Google Tag Manager container.
+ *
+ * They did not. Consent Mode v2 and the attribution capture lived only in
+ * Home/Views/head-basic.ejs, so the marketing site denied storage by default
+ * and asked, while /accounts and /dashboard loaded the same container with no
+ * consent signal and captured nothing. A visitor who pressed "Reject all" was
+ * tracked anyway on the signup page — which is precisely where the conversion
+ * fires — and an ad pointed at /accounts/register?gclid=... stored no click id,
+ * so that signup could never be attributed to the campaign that bought it.
+ *
+ * These render each origin the way Express does and assert the invariants that
+ * were being violated. They are deliberately about ORDER and SAMENESS: a
+ * consent default that arrives after the container has read the dataLayer is
+ * not a consent default, and three copies of the storage contract is how the
+ * copies stop agreeing.
+ */
+
+const REPOSITORY_ROOT: string = path.resolve(__dirname, "..", "..", "..", "..");
+
+const PARTIAL_PATH: string = path.join(
+  REPOSITORY_ROOT,
+  "Common",
+  "Server",
+  "Views",
+  "Partials",
+  "AnalyticsConsent.ejs",
+);
+
+interface Origin {
+  label: string;
+  viewPath: string;
+}
+
+/*
+ * Every OneUptime-owned origin that loads GTM-PKQD5WH. Status pages and public
+ * dashboards deliberately are not here: they render on customer-owned custom
+ * domains, where the answer is to remove the tag rather than to ask the
+ * customer's visitors for consent on OneUptime's behalf.
+ */
+const ORIGINS: Array<Origin> = [
+  {
+    label: "marketing site",
+    viewPath: path.join(REPOSITORY_ROOT, "Home", "Views", "head-basic.ejs"),
+  },
+  {
+    label: "accounts (signup)",
+    viewPath: path.join(
+      REPOSITORY_ROOT,
+      "App",
+      "FeatureSet",
+      "Accounts",
+      "views",
+      "index.ejs",
+    ),
+  },
+  {
+    label: "dashboard",
+    viewPath: path.join(
+      REPOSITORY_ROOT,
+      "App",
+      "FeatureSet",
+      "Dashboard",
+      "views",
+      "index.ejs",
+    ),
+  },
+  {
+    label: "admin dashboard",
+    viewPath: path.join(
+      REPOSITORY_ROOT,
+      "App",
+      "FeatureSet",
+      "AdminDashboard",
+      "views",
+      "index.ejs",
+    ),
+  },
+];
+
+type RenderOriginFunction = (
+  origin: Origin,
+  enableGoogleTagManager: boolean,
+) => string;
+
+const renderOrigin: RenderOriginFunction = (
+  origin: Origin,
+  enableGoogleTagManager: boolean,
+): string => {
+  return ejs.render(
+    fs.readFileSync(origin.viewPath, "utf-8"),
+    { enableGoogleTagManager: enableGoogleTagManager },
+    { filename: origin.viewPath },
+  );
+};
+
+const GTM_SCRIPT: string = "googletagmanager.com/gtm.js";
+const CONSENT_DEFAULT: string = "pushConsentSignal('default', false)";
+
+describe("the shared analytics consent partial", () => {
+  test("exists in Common, so every origin can reach it", () => {
+    expect(fs.existsSync(PARTIAL_PATH)).toBe(true);
+  });
+
+  test("does not carry Home-only concerns", () => {
+    const source: string = fs.readFileSync(PARTIAL_PATH, "utf-8");
+
+    /*
+     * The PostHog loader carries Home's own project key, and the home/-prefixed
+     * event names are the marketing site's. Moving either here would start the
+     * product reporting into Home's funnel. Reporting is handed back to the
+     * page through window.oneUptimeOnAttributionCaptured instead.
+     */
+    expect(source).not.toContain("posthog.init(");
+    // The prose may mention them; no code here may emit one.
+    expect(source).not.toContain("capture('home/");
+    expect(source).toContain("window.oneUptimeOnAttributionCaptured");
+  });
+});
+
+for (const origin of ORIGINS) {
+  describe(origin.label, () => {
+    test("defines the consent state machine", () => {
+      expect(renderOrigin(origin, true)).toContain(
+        "window.oneUptimeConsent = (function",
+      );
+    });
+
+    test("captures ad click identifiers", () => {
+      const html: string = renderOrigin(origin, true);
+
+      expect(html).toContain("window.oneUptimeGetAttribution");
+      expect(html).toContain("gclid");
+      expect(html).toContain("wbraid");
+      expect(html).toContain("gbraid");
+    });
+
+    test("reads and writes the same consent storage key as every other origin", () => {
+      /*
+       * These origins share one hostname on OneUptime Cloud, so they share one
+       * localStorage. A different key here would mean the banner answer given
+       * on the marketing site simply did not apply in the product.
+       */
+      expect(renderOrigin(origin, true)).toContain("'cookiesAccepted'");
+    });
+
+    test("pushes the Consent Mode defaults before the container loads", () => {
+      const html: string = renderOrigin(origin, true);
+
+      const consentIndex: number = html.indexOf(CONSENT_DEFAULT);
+      const containerIndex: number = html.indexOf(GTM_SCRIPT);
+
+      expect(consentIndex).toBeGreaterThan(-1);
+      expect(containerIndex).toBeGreaterThan(-1);
+
+      /*
+       * The whole point. Consent Mode defaults are only read once, when the
+       * container boots; arriving afterwards is the same as never arriving.
+       */
+      expect(consentIndex).toBeLessThan(containerIndex);
+    });
+
+    test("denies ad and analytics storage until the visitor answers", () => {
+      const html: string = renderOrigin(origin, true);
+
+      expect(html).toContain("ad_storage");
+      expect(html).toContain("ad_user_data");
+      expect(html).toContain("ad_personalization");
+      expect(html).toContain("analytics_storage");
+      // `unset` is treated as denied rather than as permission-by-silence.
+      expect(html).toContain(CONSENT_DEFAULT);
+    });
+
+    test("loads no Google tag at all when analytics are switched off", () => {
+      const html: string = renderOrigin(origin, false);
+
+      expect(html).not.toContain(GTM_SCRIPT);
+    });
+  });
+}
+
+describe("consent can be withdrawn", () => {
+  const bannerPath: string = path.join(
+    REPOSITORY_ROOT,
+    "Home",
+    "Views",
+    "cookie-banner.ejs",
+  );
+  const footerPath: string = path.join(
+    REPOSITORY_ROOT,
+    "Home",
+    "Views",
+    "footer.ejs",
+  );
+  const cookiePolicyPath: string = path.join(
+    REPOSITORY_ROOT,
+    "Home",
+    "Views",
+    "cookies.ejs",
+  );
+
+  test("the banner exposes a way to reopen itself", () => {
+    expect(fs.readFileSync(bannerPath, "utf-8")).toContain(
+      "window.oneUptimeShowCookieSettings",
+    );
+  });
+
+  test("the footer carries the settings link the policy promises", () => {
+    /*
+     * The Cookie Policy has always told visitors to use "the cookie settings
+     * link in the footer". There was no such link, so a decision could be made
+     * once and never revisited - the most commonly enforced banner defect
+     * there is.
+     */
+    const footer: string = fs.readFileSync(footerPath, "utf-8");
+
+    expect(footer).toContain("Cookie settings");
+    expect(footer).toContain("window.oneUptimeShowCookieSettings");
+  });
+
+  test("the cookie policy no longer denies using marketing cookies in the product", () => {
+    /*
+     * It said "We do not use marketing cookies inside the product" while the
+     * product loaded the same container - and therefore the same advertising
+     * tags - as the marketing site.
+     */
+    const policy: string = fs.readFileSync(cookiePolicyPath, "utf-8");
+
+    expect(policy).not.toContain(
+      "We do not use marketing cookies inside the product",
+    );
+    expect(policy).toContain("governed by the same");
+    expect(policy).toContain("consent choice");
+  });
+});