@oneuptime/common 12.0.2 → 12.0.3

package/Tests/Server/Services/StatusPageMonitorRuleMonitorCreateHook.test.ts

@@ -0,0 +1,228 @@
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import MonitorLabelRuleEngineService from "../../../Server/Services/MonitorLabelRuleEngineService";
+import MonitorOwnerRuleEngineService from "../../../Server/Services/MonitorOwnerRuleEngineService";
+import MonitorService from "../../../Server/Services/MonitorService";
+import ServiceLevelObjectiveMonitorRuleEngineService from "../../../Server/Services/ServiceLevelObjectiveMonitorRuleEngineService";
+import StatusPageMonitorRuleEngineService from "../../../Server/Services/StatusPageMonitorRuleEngineService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import { OnCreate } from "../../../Server/Types/Database/Hooks";
+import MonitorType from "../../../Types/Monitor/MonitorType";
+import ObjectID from "../../../Types/ObjectID";
+import { describe, expect, it, beforeEach, afterEach } from "@jest/globals";
+
+/*
+ * Contract under test - the create-side half of the status page monitor rule
+ * trigger, which is how monitors normally arrive on a status page. A rule that
+ * only ever noticed EDITS would leave every newly created monitor off the page
+ * until somebody happened to touch it again.
+ *
+ * MonitorService.onCreateSuccess runs its slow work on a detached promise
+ * chain (the create response must not wait for it), so these tests call the
+ * hook and then wait for the effect rather than awaiting the hook alone.
+ *
+ * Ordering matters as much as the call itself: the sync has to run AFTER
+ * MonitorLabelRuleEngineService, because a monitor created with no labels of
+ * its own can still earn them from a label rule, and those labels are exactly
+ * what a status page rule is likely to match on.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const MONITOR_ID: ObjectID = new ObjectID(
+  "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+);
+const MONITOR_STATUS_ID: ObjectID = new ObjectID(
+  "55555555-5555-4555-8555-555555555555",
+);
+
+// Calls a protected hook without widening the service's public surface.
+function callHook(
+  service: unknown,
+  name: string,
+  ...args: Array<unknown>
+): Promise<unknown> {
+  const hooks: Record<
+    string,
+    (...hookArgs: Array<unknown>) => Promise<unknown>
+  > = service as Record<
+    string,
+    (...hookArgs: Array<unknown>) => Promise<unknown>
+  >;
+
+  return hooks[name]!.apply(service, args);
+}
+
+function createdMonitor(): Monitor {
+  return {
+    id: MONITOR_ID,
+    _id: MONITOR_ID.toString(),
+    projectId: PROJECT_ID,
+    name: "Checkout API",
+    description: "tier-1",
+    // Manual monitors take no probes, which keeps the inline probe step out.
+    monitorType: MonitorType.Manual,
+    currentMonitorStatusId: MONITOR_STATUS_ID,
+  } as unknown as Monitor;
+}
+
+function onCreate(): OnCreate<Monitor> {
+  return {
+    createBy: {
+      data: createdMonitor(),
+      props: { isRoot: true, tenantId: PROJECT_ID },
+    } as unknown as CreateBy<Monitor>,
+    carryForward: null,
+  };
+}
+
+/**
+ * The chain is detached, so poll for the effect instead of awaiting the hook.
+ * Returns as soon as the predicate holds, or gives up after ~2s so a genuine
+ * regression fails loudly rather than hanging the suite.
+ */
+async function waitFor(predicate: () => boolean): Promise<void> {
+  for (let attempt: number = 0; attempt < 200; attempt++) {
+    if (predicate()) {
+      return;
+    }
+
+    await new Promise<void>((resolve: () => void) => {
+      setTimeout(resolve, 10);
+    });
+  }
+}
+
+describe("MonitorService.onCreateSuccess - putting a new monitor on the status pages that want it", () => {
+  let syncRulesForMonitorSpy: jest.SpyInstance;
+  let applyLabelRulesSpy: jest.SpyInstance;
+  const callOrder: Array<string> = [];
+
+  beforeEach(() => {
+    callOrder.length = 0;
+
+    applyLabelRulesSpy = jest
+      .spyOn(MonitorLabelRuleEngineService, "applyRulesToMonitor")
+      .mockImplementation(async () => {
+        callOrder.push("labelRules");
+      });
+
+    syncRulesForMonitorSpy = jest
+      .spyOn(StatusPageMonitorRuleEngineService, "syncRulesForMonitor")
+      .mockImplementation(async () => {
+        callOrder.push("statusPageRules");
+        return [];
+      });
+
+    jest
+      .spyOn(MonitorOwnerRuleEngineService, "applyRulesToMonitor")
+      .mockResolvedValue(undefined);
+    jest
+      .spyOn(
+        ServiceLevelObjectiveMonitorRuleEngineService,
+        "syncSlosForMonitor",
+      )
+      .mockResolvedValue([]);
+    jest
+      .spyOn(MonitorService, "findOneById")
+      .mockResolvedValue(createdMonitor());
+    /*
+     * Private/protected members of the service under test, spied so the hook
+     * never reaches the network or the database. Billing is not stubbed: the
+     * step is gated on IsBillingEnabled, which is off in tests.
+     */
+    const service: never = MonitorService as never;
+
+    jest
+      .spyOn(service, "handleWorkspaceOperationsAsync" as never)
+      .mockResolvedValue(undefined as never);
+    jest
+      .spyOn(service, "refreshMonitorProbeStatus" as never)
+      .mockResolvedValue(undefined as never);
+    jest
+      .spyOn(service, "changeMonitorStatus" as never)
+      .mockResolvedValue(undefined as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("runs the status page monitor rules for a monitor that was just created", async () => {
+    await callHook(
+      MonitorService,
+      "onCreateSuccess",
+      onCreate(),
+      createdMonitor(),
+    );
+
+    await waitFor(() => {
+      return syncRulesForMonitorSpy.mock.calls.length > 0;
+    });
+
+    expect(syncRulesForMonitorSpy).toHaveBeenCalledWith({
+      monitorId: MONITOR_ID,
+      projectId: PROJECT_ID,
+    });
+  });
+
+  /*
+   * A monitor created with no labels can be given some by a MonitorLabelRule.
+   * Running the status page rules first would evaluate them against a monitor
+   * that has not earned its labels yet, and it would land on no page at all.
+   */
+  it("runs them after the label rules, so rule-added labels are visible", async () => {
+    await callHook(
+      MonitorService,
+      "onCreateSuccess",
+      onCreate(),
+      createdMonitor(),
+    );
+
+    await waitFor(() => {
+      return callOrder.includes("statusPageRules");
+    });
+
+    expect(callOrder.indexOf("labelRules")).toBeGreaterThanOrEqual(0);
+    expect(callOrder.indexOf("statusPageRules")).toBeGreaterThan(
+      callOrder.indexOf("labelRules"),
+    );
+  });
+
+  it("does not fail the monitor create when the sync throws", async () => {
+    syncRulesForMonitorSpy.mockRejectedValue(new Error("db down"));
+
+    await expect(
+      callHook(MonitorService, "onCreateSuccess", onCreate(), createdMonitor()),
+    ).resolves.toBeDefined();
+
+    await waitFor(() => {
+      return syncRulesForMonitorSpy.mock.calls.length > 0;
+    });
+
+    expect(syncRulesForMonitorSpy).toHaveBeenCalled();
+  });
+
+  /*
+   * The label rule step is wrapped in its own try/catch that returns early on
+   * failure. If that early return also skipped the status page sync, a project
+   * with a broken label rule would quietly stop putting new monitors on its
+   * status pages.
+   */
+  it("still runs them when the label rules step fails", async () => {
+    applyLabelRulesSpy.mockRejectedValue(new Error("label rules down"));
+
+    await callHook(
+      MonitorService,
+      "onCreateSuccess",
+      onCreate(),
+      createdMonitor(),
+    );
+
+    await waitFor(() => {
+      return syncRulesForMonitorSpy.mock.calls.length > 0;
+    });
+
+    expect(syncRulesForMonitorSpy).toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/APIKey/AccessPermission.test.ts

@@ -0,0 +1,267 @@
+import {
+  afterAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+import APIKeyAccessPermission from "../../../../Server/Utils/APIKey/AccessPermission";
+import ApiKeyPermissionService from "../../../../Server/Services/ApiKeyPermissionService";
+import APIKeyPermission from "../../../../Models/DatabaseModels/ApiKeyPermission";
+import Label from "../../../../Models/DatabaseModels/Label";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserGlobalAccessPermission,
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { getJestSpyOn } from "../../../Spy";
+
+/*
+ * This class turns an API key into the permission set a request runs under, so
+ * every method here is a privilege-granting decision. The security invariant
+ * that must hold across all of them: a *default* (ordinary) API key is never
+ * silently handed ProjectOwner, while a *master* key deliberately is. A
+ * regression that leaks ProjectOwner into the default path would give every API
+ * key full control of the project; one that dropped it from the master path
+ * would break trusted internal automation. Both directions are pinned below.
+ *
+ * getApiTenantAccessPermission also reshapes stored permission rows into the
+ * runtime UserPermission shape (labels -> labelIds, block flag preserved). That
+ * mapping is where a dropped label would quietly widen a scoped permission, so
+ * it is tested against a spied service rather than a live database.
+ */
+
+const projectId: ObjectID = ObjectID.generate();
+const apiKeyId: ObjectID = ObjectID.generate();
+
+const permissionValues: (
+  permissions: Array<UserPermission>,
+) => Array<Permission> = (
+  permissions: Array<UserPermission>,
+): Array<Permission> => {
+  return permissions.map((p: UserPermission) => {
+    return p.permission;
+  });
+};
+
+describe("APIKeyAccessPermission.getDefaultApiGlobalPermission", () => {
+  it("grants Public, User and CurrentUser for the project", async () => {
+    const perm: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    expect(perm._type).toBe("UserGlobalAccessPermission");
+    expect(
+      perm.projectIds.map((p: ObjectID) => {
+        return p.toString();
+      }),
+    ).toEqual([projectId.toString()]);
+    expect(perm.globalPermissions).toEqual([
+      Permission.Public,
+      Permission.User,
+      Permission.CurrentUser,
+    ]);
+  });
+
+  it("does NOT grant ProjectOwner to an ordinary key", async () => {
+    // The core boundary: a default key must never be an owner.
+    const perm: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+    expect(perm.globalPermissions).not.toContain(Permission.ProjectOwner);
+  });
+});
+
+describe("APIKeyAccessPermission.getMasterKeyApiGlobalPermission", () => {
+  it("grants everything the default key has, plus ProjectOwner", async () => {
+    const master: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getMasterKeyApiGlobalPermission(projectId);
+    const def: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    // Superset: no default grant is lost when elevating to master.
+    for (const p of def.globalPermissions) {
+      expect(master.globalPermissions).toContain(p);
+    }
+    // The one deliberate elevation.
+    expect(master.globalPermissions).toContain(Permission.ProjectOwner);
+  });
+
+  it("scopes to exactly the one project", async () => {
+    const master: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getMasterKeyApiGlobalPermission(projectId);
+    expect(
+      master.projectIds.map((p: ObjectID) => {
+        return p.toString();
+      }),
+    ).toEqual([projectId.toString()]);
+  });
+});
+
+describe("APIKeyAccessPermission.getMasterApiTenantAccessPermission", () => {
+  it("elevates the default tenant permission with ProjectOwner", async () => {
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getMasterApiTenantAccessPermission(
+        projectId,
+      );
+
+    expect(perm._type).toBe("UserTenantAccessPermission");
+    expect(perm.projectId.toString()).toBe(projectId.toString());
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.ProjectOwner,
+    );
+    // The default tenant baseline is retained alongside the elevation.
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.CurrentUser,
+    );
+  });
+});
+
+describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
+  const spyFindBy: jest.SpyInstance = getJestSpyOn(
+    ApiKeyPermissionService,
+    "findBy",
+  );
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterAll(() => {
+    jest.restoreAllMocks();
+  });
+
+  const makeRow: (data: {
+    permission: Permission;
+    labelIds?: Array<ObjectID>;
+    isBlockPermission?: boolean;
+  }) => APIKeyPermission = (data: {
+    permission: Permission;
+    labelIds?: Array<ObjectID>;
+    isBlockPermission?: boolean;
+  }): APIKeyPermission => {
+    const row: APIKeyPermission = new APIKeyPermission();
+    row.permission = data.permission;
+    if (data.labelIds) {
+      row.labels = data.labelIds.map((id: ObjectID) => {
+        const label: Label = new Label();
+        label.id = id;
+        return label;
+      });
+    }
+    row.isBlockPermission = data.isBlockPermission ?? false;
+    return row;
+  };
+
+  it("queries the permissions for exactly this api key", async () => {
+    spyFindBy.mockResolvedValue([] as never);
+
+    await APIKeyAccessPermission.getApiTenantAccessPermission(
+      projectId,
+      apiKeyId,
+    );
+
+    expect(spyFindBy).toHaveBeenCalledTimes(1);
+    const arg: { query: { apiKeyId: ObjectID } } = spyFindBy.mock
+      .calls[0]![0] as { query: { apiKeyId: ObjectID } };
+    expect(arg.query.apiKeyId.toString()).toBe(apiKeyId.toString());
+  });
+
+  it("returns just the default baseline when the key has no permissions", async () => {
+    spyFindBy.mockResolvedValue([] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    // No stored rows -> no ProjectOwner. An empty key is not an owner.
+    expect(permissionValues(perm.permissions)).not.toContain(
+      Permission.ProjectOwner,
+    );
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.CurrentUser,
+    );
+  });
+
+  it("maps each stored permission row onto the tenant permission", async () => {
+    const labelId: ObjectID = ObjectID.generate();
+    spyFindBy.mockResolvedValue([
+      makeRow({
+        permission: Permission.CreateProjectIncident,
+        labelIds: [labelId],
+        isBlockPermission: false,
+      }),
+    ] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    expect(mapped).toBeDefined();
+    /*
+     * The label scope must survive the mapping, or the permission silently
+     * widens from "these labels" to "all".
+     */
+    expect(
+      mapped!.labelIds.map((l: ObjectID) => {
+        return l.toString();
+      }),
+    ).toEqual([labelId.toString()]);
+  });
+
+  it("preserves the block flag so a deny row stays a deny row", async () => {
+    spyFindBy.mockResolvedValue([
+      makeRow({
+        permission: Permission.CreateProjectIncident,
+        labelIds: [],
+        isBlockPermission: true,
+      }),
+    ] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    // Flipping a block permission to an allow would invert an admin's intent.
+    expect(mapped!.isBlockPermission).toBe(true);
+  });
+
+  it("treats a row with no labels as an empty (unscoped) label set", async () => {
+    const row: APIKeyPermission = new APIKeyPermission();
+    row.permission = Permission.CreateProjectIncident;
+    // labels intentionally left undefined.
+    row.isBlockPermission = false;
+    spyFindBy.mockResolvedValue([row] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    expect(mapped).toBeDefined();
+    // No crash on undefined labels, and it becomes [] rather than undefined.
+    expect(mapped!.labelIds).toEqual([]);
+  });
+});