@oneuptime/common 12.0.23 → 12.0.24

package/Tests/App/Dashboard/SecurityEventDetailObservables.test.tsx

@@ -0,0 +1,194 @@
+import "@testing-library/jest-dom";
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+import React from "react";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+
+/*
+ * The security event detail panel renders observables as pivot chips: with
+ * an onCorrelateObservable handler (the Correlate page embeds it that way)
+ * a chip pivots in place; without one (the events table) a chip deep-links
+ * to the Correlate page with the observable pre-seeded — URL-encoded, since
+ * Route.addQueryParams does not encode.
+ */
+
+const navigateMock: MockFunction = getJestMockFunction();
+
+jest.mock("../../../UI/Utils/Navigation", () => {
+  return {
+    __esModule: true,
+    default: {
+      navigate: (...args: Array<any>) => {
+        return navigateMock(...args);
+      },
+    },
+  };
+});
+
+jest.mock("../../../../App/FeatureSet/Dashboard/src/Utils/RouteMap", () => {
+  /*
+   * The mocked route keeps its :projectId placeholder and only the mocked
+   * populateRouteParams substitutes it — so the exact-URL assertions below
+   * fail if the component ever skips populateRouteParams.
+   */
+  const routeMap: Record<string, unknown> = {};
+  routeMap[PageMap.SECURITY_EVENTS_CORRELATE] = new Route(
+    "/dashboard/:projectId/security-events/correlate",
+  );
+  return {
+    __esModule: true,
+    default: routeMap,
+    RouteUtil: {
+      /*
+       * Fresh Route per call — addQueryParams mutates the instance, and a
+       * shared one would leak query params across tests.
+       */
+      populateRouteParams: (route: { toString: () => string }) => {
+        return new Route(
+          route.toString().replace(":projectId", "mock-project"),
+        );
+      },
+    },
+  };
+});
+
+/*
+ * The component import comes LAST: requiring it instantiates the mock
+ * factories above, which reference Route and PageMap — so those must be
+ * initialized first.
+ */
+import SecurityEvent from "../../../Models/AnalyticsModels/SecurityEvent";
+import Route from "../../../Types/API/Route";
+import OcsfSeverity from "../../../Types/SecurityEvent/OcsfSeverity";
+import PageMap from "../../../../App/FeatureSet/Dashboard/src/Utils/PageMap";
+import SecurityEventDetail from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventDetail";
+
+function buildEvent(observables: Array<string>): SecurityEvent {
+  const event: SecurityEvent = new SecurityEvent();
+  event.className = "Authentication";
+  event.severityName = OcsfSeverity.High;
+  event.message = "failed password for alice";
+  event.observables = observables;
+  return event;
+}
+
+beforeEach(() => {
+  navigateMock.mockReset();
+});
+
+afterEach(() => {
+  cleanup();
+});
+
+describe("SecurityEventDetail observables", () => {
+  test("renders one chip per observable", () => {
+    render(
+      <SecurityEventDetail
+        securityEvent={buildEvent(["wb-ubuntu-03", "alice", "192.168.1.20"])}
+        onClose={() => {
+          return;
+        }}
+      />,
+    );
+
+    expect(
+      screen.getByTestId("security-event-observable-chip-0"),
+    ).toHaveTextContent("wb-ubuntu-03");
+    expect(
+      screen.getByTestId("security-event-observable-chip-1"),
+    ).toHaveTextContent("alice");
+    expect(
+      screen.getByTestId("security-event-observable-chip-2"),
+    ).toHaveTextContent("192.168.1.20");
+  });
+
+  test("empty observable strings render no chip, and no observables hides the row", () => {
+    render(
+      <SecurityEventDetail
+        securityEvent={buildEvent(["", "alice"])}
+        onClose={() => {
+          return;
+        }}
+      />,
+    );
+    expect(
+      screen.getByTestId("security-event-observable-chip-0"),
+    ).toHaveTextContent("alice");
+    expect(screen.queryByTestId("security-event-observable-chip-1")).toBeNull();
+
+    cleanup();
+
+    render(
+      <SecurityEventDetail
+        securityEvent={buildEvent([])}
+        onClose={() => {
+          return;
+        }}
+      />,
+    );
+    expect(screen.queryByText("Observables")).toBeNull();
+  });
+
+  test("with an onCorrelateObservable handler, a chip pivots in place instead of navigating", () => {
+    const onCorrelateMock: MockFunction = getJestMockFunction();
+
+    render(
+      <SecurityEventDetail
+        securityEvent={buildEvent(["wb-ubuntu-03"])}
+        onClose={() => {
+          return;
+        }}
+        onCorrelateObservable={onCorrelateMock as (observable: string) => void}
+      />,
+    );
+
+    fireEvent.click(screen.getByTestId("security-event-observable-chip-0"));
+
+    expect(onCorrelateMock).toHaveBeenCalledWith("wb-ubuntu-03");
+    expect(navigateMock).not.toHaveBeenCalled();
+  });
+
+  test("without a handler, a chip deep-links to Correlate with the observable pre-seeded", () => {
+    render(
+      <SecurityEventDetail
+        securityEvent={buildEvent(["wb-ubuntu-03"])}
+        onClose={() => {
+          return;
+        }}
+      />,
+    );
+
+    fireEvent.click(screen.getByTestId("security-event-observable-chip-0"));
+
+    expect(navigateMock).toHaveBeenCalledTimes(1);
+    const route: Route = navigateMock.mock.calls[0]?.[0] as Route;
+    expect(route.toString()).toBe(
+      "/dashboard/mock-project/security-events/correlate?observable=wb-ubuntu-03",
+    );
+  });
+
+  test("observable values are URL-encoded into the deep link", () => {
+    render(
+      <SecurityEventDetail
+        securityEvent={buildEvent(["svc account&admin"])}
+        onClose={() => {
+          return;
+        }}
+      />,
+    );
+
+    fireEvent.click(screen.getByTestId("security-event-observable-chip-0"));
+
+    const route: Route = navigateMock.mock.calls[0]?.[0] as Route;
+    expect(route.toString()).toContain(
+      `observable=${encodeURIComponent("svc account&admin")}`,
+    );
+  });
+});

package/Tests/App/Dashboard/SecurityEventsDetectionRulesPage.test.tsx

@@ -24,6 +24,10 @@ import { MemoryRouter } from "react-router-dom";
 type CapturedFormField = {
   field: Record<string, boolean>;
   title: string;
+  fieldType?: unknown;
+  stepId?: string | undefined;
+  required?: boolean | undefined;
+  validation?: { minValue?: number | undefined } | undefined;
   showIf?: ((model: Record<string, unknown>) => boolean) | undefined;
   dropdownModal?: { type: unknown } | undefined;
 };
@@ -43,6 +47,7 @@ type CapturedTableProps = {
   formFields?: Array<CapturedFormField>;
   actionButtons?: Array<CapturedActionButton>;
   createInitialValues?: Record<string, unknown>;
+  helpContent?: { markdown?: string | undefined } | undefined;
 };
 
 let capturedTableProps: CapturedTableProps | null = null;
@@ -58,6 +63,7 @@ jest.mock("../../../UI/Components/ModelTable/ModelTable", () => {
 });
 
 import DetectionRulesPage from "../../../../App/FeatureSet/Dashboard/src/Pages/SecurityEvents/DetectionRules";
+import FormFieldSchemaType from "../../../UI/Components/Forms/Types/FormFieldSchemaType";
 import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
 import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
 import Project from "../../../Models/DatabaseModels/Project";
@@ -172,6 +178,124 @@ describe("Detection Rules page", () => {
     });
   });
 
+  describe("distinct count and match threshold fields", () => {
+    /*
+     * Issue #3398: a rule can now count unique values of one field
+     * (distinctCountField) instead of raw matching events, and hold fire
+     * until the count reaches matchCountThreshold. Both knobs are plain
+     * form configuration on the evaluation step — dropping either one is
+     * type-safe and render-safe, so the captured props are the only place
+     * they can be pinned.
+     */
+    test("the Distinct Count Field is an optional text field", () => {
+      renderPage();
+
+      const field: CapturedFormField = fieldTitled("Distinct Count Field");
+
+      expect(field.field).toEqual({ distinctCountField: true });
+      expect(field.fieldType).toBe(FormFieldSchemaType.Text);
+      expect(field.required).toBe(false);
+    });
+
+    test("the Match Count Threshold is a required number field that refuses values below 1", () => {
+      renderPage();
+
+      const field: CapturedFormField = fieldTitled("Match Count Threshold");
+
+      expect(field.field).toEqual({ matchCountThreshold: true });
+      expect(field.fieldType).toBe(FormFieldSchemaType.Number);
+      expect(field.required).toBe(true);
+      /*
+       * The service rejects 0 and negatives with a BadDataException; the
+       * form must stop them before submit.
+       */
+      expect(field.validation?.minValue).toBe(1);
+    });
+
+    test("both new fields sit on the evaluation step alongside Group By Field", () => {
+      renderPage();
+
+      expect(fieldTitled("Group By Field").stepId).toBe("evaluation");
+      expect(fieldTitled("Distinct Count Field").stepId).toBe("evaluation");
+      expect(fieldTitled("Match Count Threshold").stepId).toBe("evaluation");
+    });
+
+    test("a fresh create form seeds matchCountThreshold with the DB default of 1", () => {
+      /*
+       * matchCountThreshold is NOT NULL DEFAULT 1 in the schema and the
+       * form field is required — without this initial value a fresh
+       * create form would open with a required number field left blank.
+       */
+      renderPage();
+
+      expect(capturedTableProps?.createInitialValues).toMatchObject({
+        matchCountThreshold: 1,
+      });
+    });
+
+    test("the help documentation explains both new controls", () => {
+      renderPage();
+
+      const markdown: string = capturedTableProps?.helpContent?.markdown || "";
+
+      expect(markdown).toContain("Distinct Count Field");
+      expect(markdown).toContain("Match Count Threshold");
+    });
+  });
+
+  describe("the Sigma rule field is a YAML editor", () => {
+    /*
+     * The rule is YAML — SigmaRuleParser runs js-yaml over it and
+     * DetectionRuleService rejects a create or update whose rule does not
+     * compile. It was declared as Markdown, which put a rich-text toolbar
+     * (Bold, H1) over a Sigma rule and, worse, routed the value through an
+     * editor that round-trips through HTML. Indentation-sensitive YAML does
+     * not survive that.
+     */
+    test("it is declared as YAML", () => {
+      renderPage();
+
+      expect(fieldTitled("Sigma Rule (YAML)").fieldType).toBe(
+        FormFieldSchemaType.YAML,
+      );
+    });
+
+    test("it is not the Markdown editor", () => {
+      renderPage();
+
+      expect(fieldTitled("Sigma Rule (YAML)").fieldType).not.toBe(
+        FormFieldSchemaType.Markdown,
+      );
+    });
+
+    test("it still binds to sigmaRuleYaml on its own form step", () => {
+      renderPage();
+
+      const field: CapturedFormField = fieldTitled("Sigma Rule (YAML)");
+
+      expect(field.field).toEqual({ sigmaRuleYaml: true });
+      expect((field as unknown as { stepId?: string | undefined }).stepId).toBe(
+        "sigma-rule",
+      );
+      expect(
+        (field as unknown as { required?: boolean | undefined }).required,
+      ).toBe(true);
+    });
+
+    test("no other field on the page was switched to YAML by accident", () => {
+      renderPage();
+
+      const yamlFields: Array<CapturedFormField> = (
+        capturedTableProps?.formFields || []
+      ).filter((field: CapturedFormField): boolean => {
+        return field.fieldType === FormFieldSchemaType.YAML;
+      });
+
+      expect(yamlFields).toHaveLength(1);
+      expect(yamlFields[0]?.title).toBe("Sigma Rule (YAML)");
+    });
+  });
+
   describe("Create Monitor row action", () => {
     test("navigates to monitor create carrying the rule id", () => {
       renderPage();

package/Tests/App/Dashboard/SecurityEventsMonitorStepForm.test.tsx

@@ -18,19 +18,24 @@ import ProjectUtil from "../../../UI/Utils/Project";
 import ObjectID from "../../../Types/ObjectID";
 
 /*
- * The step form's field gating IS the feature here: Event Class was moved
- * out from behind the "Show Advanced Options" toggle so that watching
- * Detection Findings — the single most useful class filter — no longer
- * requires knowing the toggle exists. No other test renders this form
- * (the view-model and type tests cover different layers), so without
- * this one a refactor could quietly put the field back behind the toggle
- * and nothing would fail.
+ * The step form's field gating IS the feature here: Event Class and — as
+ * of issue #3398 — Event Severity live outside the "Show Advanced
+ * Options" toggle, because hiding them read as "monitors cannot filter
+ * by class/severity" to anyone who did not know the toggle existed.
+ * Only the service and attribute filters stay behind it. No other test
+ * renders this form (the view-model and type tests cover different
+ * layers), so without this one a refactor could quietly put a field
+ * back behind the toggle and nothing would fail.
  */
 
 const PROJECT_ID: ObjectID = new ObjectID(
   "11111111-1111-4111-8111-111111111111",
 );
 
+const TELEMETRY_SERVICE_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+
 function renderForm(config?: Partial<MonitorStepSecurityEventsMonitor>): void {
   render(
     <SecurityEventsMonitorStepForm
@@ -58,20 +63,20 @@ describe("SecurityEventsMonitorStepForm field gating", () => {
     jest.restoreAllMocks();
   });
 
-  test("Event Class is visible without opening advanced options", async () => {
+  test("severity and class are visible without opening advanced options", async () => {
     renderForm();
 
     // findBy: lets the preview's initial async count resolve inside act.
-    expect(await screen.findByText("Event Class")).toBeInTheDocument();
+    expect(await screen.findByText("Event Severity")).toBeInTheDocument();
+    expect(screen.getByText("Event Class")).toBeInTheDocument();
     expect(screen.getByText("Show Advanced Options")).toBeInTheDocument();
   });
 
-  test("severity, service and attribute filters stay behind the toggle", async () => {
+  test("service and attribute filters stay behind the toggle", async () => {
     renderForm();
 
     await screen.findByText("Event Class");
 
-    expect(screen.queryByText("Event Severity")).not.toBeInTheDocument();
     expect(
       screen.queryByText("Filter by Telemetry Service"),
     ).not.toBeInTheDocument();
@@ -79,28 +84,83 @@ describe("SecurityEventsMonitorStepForm field gating", () => {
 
     fireEvent.click(screen.getByText("Show Advanced Options"));
 
-    expect(screen.getByText("Event Severity")).toBeInTheDocument();
     expect(screen.getByText("Filter by Telemetry Service")).toBeInTheDocument();
     expect(screen.getByText("Filter by Attributes")).toBeInTheDocument();
   });
 
-  test("a stored severity filter still opens the advanced section by itself", async () => {
+  test("a stored severity filter alone no longer forces the advanced section open", async () => {
     /*
-     * Editing a monitor whose config uses an advanced filter must show
-     * that filter immediately — the auto-open behaviour classNames used
-     * to share before it stopped being advanced.
+     * severityNames left the auto-open heuristic together with the
+     * toggle: the field is always on screen now, so a monitor that only
+     * filters by severity has nothing hidden worth revealing.
      */
     renderForm({ severityNames: ["High" as never] });
 
     expect(await screen.findByText("Event Severity")).toBeInTheDocument();
-    expect(screen.getByText("Hide Advanced Options")).toBeInTheDocument();
+    expect(
+      screen.queryByText("Filter by Telemetry Service"),
+    ).not.toBeInTheDocument();
+    expect(screen.getByText("Show Advanced Options")).toBeInTheDocument();
   });
 
-  test("a stored class filter alone no longer forces the advanced section open", async () => {
+  test("a stored class filter alone does not force the advanced section open", async () => {
     renderForm({ classNames: ["Detection Finding"] });
 
     expect(await screen.findByText("Event Class")).toBeInTheDocument();
-    expect(screen.queryByText("Event Severity")).not.toBeInTheDocument();
+    expect(
+      screen.queryByText("Filter by Telemetry Service"),
+    ).not.toBeInTheDocument();
     expect(screen.getByText("Show Advanced Options")).toBeInTheDocument();
   });
+
+  test("a stored telemetry-service filter still opens the advanced section by itself", async () => {
+    /*
+     * Editing a monitor whose config uses a filter that IS still
+     * advanced must show that filter immediately — the auto-open
+     * behaviour severityNames used to share before it stopped being
+     * advanced.
+     */
+    renderForm({ telemetryServiceIds: [TELEMETRY_SERVICE_ID] });
+
+    expect(
+      await screen.findByText("Filter by Telemetry Service"),
+    ).toBeInTheDocument();
+    expect(screen.getByText("Hide Advanced Options")).toBeInTheDocument();
+  });
+
+  test("a stored attribute filter still opens the advanced section by itself", async () => {
+    renderForm({ attributes: { "user.name": "root" } });
+
+    expect(await screen.findByText("Filter by Attributes")).toBeInTheDocument();
+    expect(screen.getByText("Hide Advanced Options")).toBeInTheDocument();
+
+    /*
+     * The stored entry hydrates a dictionary row, and that row must
+     * carry the operator dropdown — the same operator restore the
+     * Log/Trace monitors rely on.
+     */
+    expect(screen.getByText("Operator")).toBeInTheDocument();
+  });
+
+  test("the attributes filter offers an operator on every new entry", async () => {
+    /*
+     * dictionaryEnableOperators is the other half of #3398: without it
+     * the dictionary renders a fixed "=" between key and value; with it
+     * each row gets an "Operator" dropdown (contains, is any of, ...).
+     */
+    renderForm();
+
+    await screen.findByText("Event Class");
+
+    fireEvent.click(screen.getByText("Show Advanced Options"));
+
+    // No rows yet, so no per-row controls either.
+    expect(screen.queryByText("Operator")).not.toBeInTheDocument();
+
+    fireEvent.click(screen.getByText("Add Filter by Attributes"));
+
+    expect(screen.getByText("Operator")).toBeInTheDocument();
+    expect(screen.getByText("Key")).toBeInTheDocument();
+    expect(screen.getByText("Value")).toBeInTheDocument();
+  });
 });