@oneuptime/common 12.0.24 → 12.0.25

package/Tests/Server/API/BaseAPI.test.ts

@@ -151,6 +151,7 @@ describe("BaseAPI", () => {
   } as OneUptimeRequest;
 
   beforeAll(async () => {
+    mockRouter.routes.length = 0;
     mockRouter.post.mockClear();
     mockRouter.get.mockClear();
     mockRouter.put.mockClear();
@@ -208,11 +209,49 @@ describe("BaseAPI", () => {
         expect.any(Function),
       );
 
+      expect(Express.getRouter().post).toHaveBeenCalledWith(
+        "/mock/:id/update-item",
+        UserMiddleware.getUserMiddleware,
+        expect.any(Function),
+      );
+
       expect(Express.getRouter().delete).toHaveBeenCalledWith(
         "/mock/:id",
         UserMiddleware.getUserMiddleware,
         expect.any(Function),
       );
+
+      expect(Express.getRouter().post).toHaveBeenCalledWith(
+        "/mock/:id/delete-item",
+        UserMiddleware.getUserMiddleware,
+        expect.any(Function),
+      );
+    });
+
+    it("does not register state-changing GET aliases", () => {
+      const registeredGetPaths: Array<string> = mockRouter.routes
+        .filter((route: { method: string }) => {
+          return route.method === "GET";
+        })
+        .map((route: { uri: string }) => {
+          return route.uri;
+        });
+
+      expect(registeredGetPaths).not.toContain("/mock/:id/update-item");
+      expect(registeredGetPaths).not.toContain("/mock/:id/delete-item");
+    });
+
+    it("keeps read-only GET compatibility routes", () => {
+      const registeredGetPaths: Array<string> = mockRouter.routes
+        .filter((route: { method: string }) => {
+          return route.method === "GET";
+        })
+        .map((route: { uri: string }) => {
+          return route.uri;
+        });
+
+      expect(registeredGetPaths).toContain("/mock/get-list");
+      expect(registeredGetPaths).toContain("/mock/:id/get-item");
     });
   });
 
@@ -226,7 +265,9 @@ describe("BaseAPI", () => {
       ["POST", "/mock/:id/get-item", "getItem"],
       ["GET", "/mock/:id/get-item", "getItem"],
       ["PUT", "/mock/:id", "updateItem"],
+      ["POST", "/mock/:id/update-item", "updateItem"],
       ["DELETE", "/mock/:id", "deleteItem"],
+      ["POST", "/mock/:id/delete-item", "deleteItem"],
     ] as [string, string, string][];
 
     for (const [method, uri, shouldBeCalled] of checkRoutes) {

package/Tests/Server/API/BaseAPIUpdatePayloadValidation.test.ts

@@ -261,11 +261,7 @@ describe("BaseAPI.updateItem payload validation", () => {
     });
   });
 
-  /*
-   * PUT /:id, POST /:id/update-item and GET /:id/update-item all land on this
-   * one handler, so none of them can be left answering 200 to a payload that
-   * writes nothing. GET carries no body at all.
-   */
+  /* PUT /:id and POST /:id/update-item both land on this one handler. */
   describe("across every route that reaches updateItem", () => {
     it("refuses the flat body on the POST update-item route", async () => {
       const request: OneUptimeRequest = requestWithBody({
@@ -278,15 +274,7 @@ describe("BaseAPI.updateItem payload validation", () => {
       );
     });
 
-    it("refuses the bodyless GET update-item route instead of quietly writing nothing", async () => {
-      await expect(
-        api.updateItem(requestWithBody({}), response),
-      ).rejects.toThrow(BadDataException);
-
-      expect(service.updateOneById).not.toHaveBeenCalled();
-    });
-
-    it("registers all three update routes", () => {
+    it("registers only non-GET update routes", () => {
       const crudPath: string = new Probe().getCrudApiPath()!.toString();
 
       expect(mockRouter.match("PUT", `${crudPath}/:id`)).toBeTruthy();
@@ -294,8 +282,13 @@ describe("BaseAPI.updateItem payload validation", () => {
         mockRouter.match("POST", `${crudPath}/:id/update-item`),
       ).toBeTruthy();
       expect(
-        mockRouter.match("GET", `${crudPath}/:id/update-item`),
-      ).toBeTruthy();
+        mockRouter.routes.some((route: { method: string; uri: string }) => {
+          return (
+            route.method === "GET" &&
+            route.uri === `${crudPath}/:id/update-item`
+          );
+        }),
+      ).toBe(false);
     });
   });
 

package/Tests/Server/Middleware/SlackAuthorization.test.ts

@@ -1,5 +1,6 @@
-import { describe, expect, test, beforeEach } from "@jest/globals";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
 import crypto from "crypto";
+import GlobalCache from "../../../Server/Infrastructure/GlobalCache";
 import SlackAuthorization from "../../../Server/Middleware/SlackAuthorization";
 import Response from "../../../Server/Utils/Response";
 import {
@@ -8,6 +9,7 @@ import {
   OneUptimeRequest,
 } from "../../../Server/Utils/Express";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import ServiceUnavailableException from "../../../Types/Exception/ServiceUnavailableException";
 
 const SIGNING_SECRET: string = "slack-app-signing-secret";
 
@@ -28,6 +30,16 @@ jest.mock("../../../Server/Utils/Response", () => {
     __esModule: true,
     default: {
       sendErrorResponse: jest.fn(),
+      sendTextResponse: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../Server/Infrastructure/GlobalCache", () => {
+  return {
+    __esModule: true,
+    default: {
+      setStringIfNotExists: jest.fn(),
     },
   };
 });
@@ -41,11 +53,16 @@ jest.mock("../../../Server/Utils/Response", () => {
  * have to come back as the intended 400.
  */
 describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
-  const TIMESTAMP: string = "1700000000";
+  const NOW_IN_SECONDS: number = 1_800_000_000;
+  const TIMESTAMP: string = NOW_IN_SECONDS.toString();
   const RAW_BODY: string = "token=abc&team_id=T123&command=%2Foneuptime";
 
   const sendErrorResponse: jest.Mock =
     Response.sendErrorResponse as unknown as jest.Mock;
+  const sendTextResponse: jest.Mock =
+    Response.sendTextResponse as unknown as jest.Mock;
+  const setStringIfNotExists: jest.Mock =
+    GlobalCache.setStringIfNotExists as unknown as jest.Mock;
 
   const res: ExpressResponse = {} as ExpressResponse;
   let next: NextFunction;
@@ -62,15 +79,19 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
   type BuildRequestFunction = (
     signature: string | undefined,
     body?: string,
+    timestamp?: string | null,
   ) => OneUptimeRequest;
 
   const buildRequest: BuildRequestFunction = (
     signature: string | undefined,
     body: string = RAW_BODY,
+    timestamp: string | null = TIMESTAMP,
   ): OneUptimeRequest => {
-    const headers: Record<string, string> = {
-      "x-slack-request-timestamp": TIMESTAMP,
-    };
+    const headers: Record<string, string> = {};
+
+    if (timestamp !== null) {
+      headers["x-slack-request-timestamp"] = timestamp;
+    }
 
     if (signature !== undefined) {
       headers["x-slack-signature"] = signature;
@@ -81,9 +102,15 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    jest.spyOn(Date, "now").mockReturnValue(NOW_IN_SECONDS * 1000);
+    setStringIfNotExists.mockResolvedValue(true);
     next = jest.fn();
   });
 
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
   test("calls next when the signature matches the timestamp and body", async () => {
     const req: OneUptimeRequest = buildRequest(sign(TIMESTAMP, RAW_BODY));
 
@@ -91,6 +118,12 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
 
     expect(next).toHaveBeenCalled();
     expect(sendErrorResponse).not.toHaveBeenCalled();
+    expect(setStringIfNotExists).toHaveBeenCalledWith(
+      "slack-request-replay",
+      sign(TIMESTAMP, RAW_BODY).slice("v0=".length),
+      TIMESTAMP,
+      { expiresInSeconds: 5 * 60 + 1 },
+    );
   });
 
   test("rejects a well-formed signature computed over a different body", async () => {
@@ -107,6 +140,212 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
       res,
       new BadDataException("Slack Signature Verification Failed."),
     );
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
+
+  test("accepts a request exactly five minutes old", async () => {
+    const timestamp: string = (NOW_IN_SECONDS - 5 * 60).toString();
+    const req: OneUptimeRequest = buildRequest(
+      sign(timestamp, RAW_BODY),
+      RAW_BODY,
+      timestamp,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("accepts a request exactly five minutes in the future and covers the full replay window", async () => {
+    const timestamp: string = (NOW_IN_SECONDS + 5 * 60).toString();
+    const req: OneUptimeRequest = buildRequest(
+      sign(timestamp, RAW_BODY),
+      RAW_BODY,
+      timestamp,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(setStringIfNotExists).toHaveBeenCalledWith(
+      "slack-request-replay",
+      sign(timestamp, RAW_BODY).slice("v0=".length),
+      timestamp,
+      { expiresInSeconds: 10 * 60 + 1 },
+    );
+  });
+
+  test("rejects a correctly signed request older than five minutes", async () => {
+    const timestamp: string = (NOW_IN_SECONDS - 5 * 60 - 1).toString();
+    const req: OneUptimeRequest = buildRequest(
+      sign(timestamp, RAW_BODY),
+      RAW_BODY,
+      timestamp,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Slack Signature Verification Failed."),
+    );
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
+
+  test("rejects a correctly signed request more than five minutes in the future", async () => {
+    const timestamp: string = (NOW_IN_SECONDS + 5 * 60 + 1).toString();
+    const req: OneUptimeRequest = buildRequest(
+      sign(timestamp, RAW_BODY),
+      RAW_BODY,
+      timestamp,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Slack Signature Verification Failed."),
+    );
+  });
+
+  test("acknowledges a duplicate without invoking the Slack handler", async () => {
+    setStringIfNotExists.mockResolvedValue(false);
+    const req: OneUptimeRequest = buildRequest(sign(TIMESTAMP, RAW_BODY));
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+    expect(sendTextResponse).toHaveBeenCalledWith(req, res, "");
+  });
+
+  test("uses the canonical digest so signature casing cannot bypass replay detection", async () => {
+    const lowercaseSignature: string = sign(TIMESTAMP, RAW_BODY);
+    const uppercaseSignature: string = `v0=${lowercaseSignature
+      .slice("v0=".length)
+      .toUpperCase()}`;
+    const firstRequest: OneUptimeRequest = buildRequest(lowercaseSignature);
+    const replayRequest: OneUptimeRequest = buildRequest(uppercaseSignature);
+
+    setStringIfNotExists
+      .mockResolvedValueOnce(true)
+      .mockResolvedValueOnce(false);
+
+    await SlackAuthorization.isAuthorizedSlackRequest(firstRequest, res, next);
+    await SlackAuthorization.isAuthorizedSlackRequest(replayRequest, res, next);
+
+    const canonicalDigest: string = lowercaseSignature.slice("v0=".length);
+    expect(setStringIfNotExists).toHaveBeenNthCalledWith(
+      1,
+      "slack-request-replay",
+      canonicalDigest,
+      TIMESTAMP,
+      { expiresInSeconds: 5 * 60 + 1 },
+    );
+    expect(setStringIfNotExists).toHaveBeenNthCalledWith(
+      2,
+      "slack-request-replay",
+      canonicalDigest,
+      TIMESTAMP,
+      { expiresInSeconds: 5 * 60 + 1 },
+    );
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(sendTextResponse).toHaveBeenCalledWith(replayRequest, res, "");
+  });
+
+  test("allows repeated URL verification requests to reach their idempotent handler", async () => {
+    const signature: string = sign(TIMESTAMP, RAW_BODY);
+    const firstRequest: OneUptimeRequest = buildRequest(signature);
+    const secondRequest: OneUptimeRequest = buildRequest(signature);
+
+    Object.assign(firstRequest, {
+      route: { path: "/slack/events" },
+      body: { type: "url_verification" },
+    });
+    Object.assign(secondRequest, {
+      route: { path: "/slack/events" },
+      body: { type: "url_verification" },
+    });
+
+    await SlackAuthorization.isAuthorizedSlackRequest(firstRequest, res, next);
+    await SlackAuthorization.isAuthorizedSlackRequest(secondRequest, res, next);
+
+    expect(next).toHaveBeenCalledTimes(2);
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
+
+  test("allows repeated options loads to reach their idempotent handler", async () => {
+    const signature: string = sign(TIMESTAMP, RAW_BODY);
+    const firstRequest: OneUptimeRequest = buildRequest(signature);
+    const secondRequest: OneUptimeRequest = buildRequest(signature);
+
+    Object.assign(firstRequest, {
+      route: { path: "/slack/options-load" },
+    });
+    Object.assign(secondRequest, {
+      route: { path: "/slack/options-load" },
+    });
+
+    await SlackAuthorization.isAuthorizedSlackRequest(firstRequest, res, next);
+    await SlackAuthorization.isAuthorizedSlackRequest(secondRequest, res, next);
+
+    expect(next).toHaveBeenCalledTimes(2);
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
+
+  test("fails closed when distributed replay protection is unavailable", async () => {
+    setStringIfNotExists.mockRejectedValue(new Error("cache unavailable"));
+    const req: OneUptimeRequest = buildRequest(sign(TIMESTAMP, RAW_BODY));
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new ServiceUnavailableException(
+        "Slack request verification is temporarily unavailable.",
+      ),
+    );
+  });
+
+  const malformedTimestamps: Array<[string, string | null]> = [
+    ["absent", null],
+    ["empty", ""],
+    ["non-numeric", "not-a-timestamp"],
+    ["partially numeric", `${TIMESTAMP}abc`],
+    ["fractional", `${TIMESTAMP}.5`],
+    ["negative", "-1"],
+    ["outside the safe integer range", "999999999999999999999"],
+  ];
+
+  describe("rejects a malformed timestamp", () => {
+    test.each(malformedTimestamps)(
+      "%s",
+      async (_label: string, timestamp: string | null) => {
+        const signedTimestamp: string = timestamp || TIMESTAMP;
+        const req: OneUptimeRequest = buildRequest(
+          sign(signedTimestamp, RAW_BODY),
+          RAW_BODY,
+          timestamp,
+        );
+
+        await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+        expect(next).not.toHaveBeenCalled();
+        expect(sendErrorResponse).toHaveBeenCalledWith(
+          req,
+          res,
+          new BadDataException("Slack Signature Verification Failed."),
+        );
+        expect(setStringIfNotExists).not.toHaveBeenCalled();
+      },
+    );
   });
 
   /*
@@ -143,7 +382,25 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
           res,
           new BadDataException("Slack Signature Verification Failed."),
         );
+        expect(setStringIfNotExists).not.toHaveBeenCalled();
       },
     );
   });
+
+  test("normalizes an array signature header without throwing", async () => {
+    const req: OneUptimeRequest = buildRequest(undefined);
+    req.headers["x-slack-signature"] = ["not-a-signature"];
+
+    await expect(
+      SlackAuthorization.isAuthorizedSlackRequest(req, res, next),
+    ).resolves.toBeUndefined();
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Slack Signature Verification Failed."),
+    );
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
 });

package/Tests/Server/Utils/Telemetry/LlmCostBudgetEvaluator.test.ts

@@ -19,6 +19,7 @@ import LlmCostBudgetService from "../../../../Server/Services/LlmCostBudgetServi
 import MetricService from "../../../../Server/Services/MetricService";
 import SpanService from "../../../../Server/Services/SpanService";
 import TelemetryUtil from "../../../../Server/Utils/Telemetry/Telemetry";
+import { LlmMicroUsdCostMetricNames } from "../../../../Types/Telemetry/LlmMetricConventions";
 import { LlmMetricScope } from "../../../../Utils/Telemetry/LlmMetricQuery";
 /*
  * `jest` deliberately comes from the global scope, not @jest/globals — the
@@ -84,6 +85,34 @@ const mockedMetricService: {
   aggregateBy: MockedFn;
 };
 
+/*
+ * Metric-sourced cost is TWO aggregates, not one: the USD-denominated metric
+ * names and the micro-USD ones (the Codex CLI reports millionths of a dollar)
+ * are queried separately and scaled before being added, because a single Sum
+ * over both units cannot be un-mixed afterwards. A plain mockResolvedValue
+ * answers BOTH queries with the same payload, which would feed the same
+ * figure in twice — once at 1e-6 — and quietly skew every expectation here.
+ *
+ * So the mock dispatches on the metric names the query actually selects: the
+ * rows are the project's USD spend, and the micro-USD query correctly finds
+ * nothing.
+ */
+function mockUsdMetricRows(rows: Array<JSONObject>): void {
+  mockedMetricService.aggregateBy.mockImplementation(
+    (aggregate: { query: Record<string, unknown> }): Promise<JSONObject> => {
+      const names: Array<string> = ((
+        aggregate?.query?.["name"] as { values?: Array<string> } | undefined
+      )?.values || []) as Array<string>;
+
+      const isMicroUsd: boolean = names.some((name: string) => {
+        return LlmMicroUsdCostMetricNames.includes(name);
+      });
+
+      return Promise.resolve({ data: isMicroUsd ? [] : rows });
+    },
+  );
+}
+
 const mockedBudgetService: {
   findBy: MockedFn;
   updateOneById: MockedFn;
@@ -596,9 +625,7 @@ describe("LlmCostBudgetEvaluator.resolveSpend — source selection", () => {
   }
 
   function mockMetricSpend(value: number): void {
-    mockedMetricService.aggregateBy.mockResolvedValue({
-      data: [{ timestamp: NOW, value: value }],
-    } as never);
+    mockUsdMetricRows([{ timestamp: NOW, value: value }]);
   }
 
   test("uses spans when the span stream reported spend", async () => {
@@ -730,12 +757,10 @@ describe("LlmCostBudgetEvaluator.resolveSpend — source selection", () => {
   });
 
   test("sums multiple metric buckets", async () => {
-    mockedMetricService.aggregateBy.mockResolvedValue({
-      data: [
-        { timestamp: NOW, value: 1.5 },
-        { timestamp: NOW, value: 2.5 },
-      ],
-    } as never);
+    mockUsdMetricRows([
+      { timestamp: NOW, value: 1.5 },
+      { timestamp: NOW, value: 2.5 },
+    ]);
 
     await expect(
       LlmCostBudgetEvaluator.resolveSpend({
@@ -781,9 +806,7 @@ describe("LlmCostBudgetEvaluator.evaluateBudget — metric-sourced spend", () =>
   });
 
   test("a metrics-only project gets its spend stamped on the budget row", async () => {
-    mockedMetricService.aggregateBy.mockResolvedValue({
-      data: [{ timestamp: NOW, value: 60 }],
-    } as never);
+    mockUsdMetricRows([{ timestamp: NOW, value: 60 }]);
 
     const budget: LlmCostBudget = makeBudget({ dailyBudgetInUSD: 100 });
 
@@ -798,9 +821,7 @@ describe("LlmCostBudgetEvaluator.evaluateBudget — metric-sourced spend", () =>
   });
 
   test("a metrics-only project publishes the same budget series as a span-backed one", async () => {
-    mockedMetricService.aggregateBy.mockResolvedValue({
-      data: [{ timestamp: NOW, value: 80 }],
-    } as never);
+    mockUsdMetricRows([{ timestamp: NOW, value: 80 }]);
 
     await LlmCostBudgetEvaluator.evaluateBudget({
       budget: makeBudget({ dailyBudgetInUSD: 100 }),
@@ -823,9 +844,7 @@ describe("LlmCostBudgetEvaluator.evaluateBudget — metric-sourced spend", () =>
    * have to learn about the source.
    */
   test("the published series carries no source-specific attribute", async () => {
-    mockedMetricService.aggregateBy.mockResolvedValue({
-      data: [{ timestamp: NOW, value: 5 }],
-    } as never);
+    mockUsdMetricRows([{ timestamp: NOW, value: 5 }]);
 
     const budget: LlmCostBudget = makeBudget();