@oneuptime/common 12.0.24 → 12.0.26

package/Tests/Server/Utils/SecurityEvent/SecurityEventAlerting.test.ts

@@ -0,0 +1,246 @@
+/*
+ * The alert creation path pulls the native isolated-vm addon through its
+ * template renderer; stub it out before anything imports it.
+ */
+jest.mock("isolated-vm", () => {
+  return {};
+});
+
+import {
+  AlertableMatch,
+  openDedupedAlerts,
+  openDedupedIncidents,
+  pickSeverityByPrecedence,
+} from "../../../../Server/Utils/SecurityEvent/SecurityEventAlerting";
+import Alert from "../../../../Models/DatabaseModels/Alert";
+import Incident from "../../../../Models/DatabaseModels/Incident";
+import AlertService from "../../../../Server/Services/AlertService";
+import IncidentService from "../../../../Server/Services/IncidentService";
+import logger from "../../../../Server/Utils/Logger";
+import Includes from "../../../../Types/BaseDatabase/Includes";
+import ObjectID from "../../../../Types/ObjectID";
+import { JSONObject } from "../../../../Types/JSON";
+import { getJestSpyOn } from "../../../Spy";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * The shared alerting machinery both detection sources ride (Sigma rules
+ * and threat-intel feeds): fingerprint-scoped dedupe against unresolved
+ * state, per-item guarded creates, and the severity precedence ladder.
+ * Behavior here is ALSO pinned end-to-end by DetectionRuleEvaluator's own
+ * suite; these tests pin the extracted module directly so a regression
+ * names the guilty layer.
+ */
+
+type Spy = ReturnType<typeof getJestSpyOn>;
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const SEVERITY_ID: ObjectID = new ObjectID(
+  "55555555-5555-4555-8555-555555555555",
+);
+
+function buildMatch(fingerprint: string): AlertableMatch {
+  return {
+    fingerprint,
+    title: `title for ${fingerprint}`,
+    description: "what happened",
+    rootCause: "the source matched",
+  };
+}
+
+let alertFindSpy: Spy;
+let alertCreateSpy: Spy;
+let incidentFindSpy: Spy;
+let incidentCreateSpy: Spy;
+
+beforeEach(() => {
+  alertFindSpy = getJestSpyOn(AlertService, "findBy").mockResolvedValue(
+    [] as never,
+  );
+  alertCreateSpy = getJestSpyOn(AlertService, "create").mockResolvedValue(
+    new Alert() as never,
+  );
+  incidentFindSpy = getJestSpyOn(IncidentService, "findBy").mockResolvedValue(
+    [] as never,
+  );
+  incidentCreateSpy = getJestSpyOn(IncidentService, "create").mockResolvedValue(
+    new Incident() as never,
+  );
+  getJestSpyOn(logger, "error").mockImplementation((() => {
+    return undefined;
+  }) as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("openDedupedAlerts", () => {
+  test("dedupe is scoped to the candidate fingerprints against unresolved alerts", async () => {
+    await openDedupedAlerts({
+      projectId: PROJECT_ID,
+      alertSeverityId: SEVERITY_ID,
+      logLabel: "test",
+      matches: [buildMatch("fp-1"), buildMatch("fp-2")],
+    });
+
+    const query: JSONObject = (alertFindSpy.mock.calls[0]![0] as JSONObject)[
+      "query"
+    ] as JSONObject;
+    expect(query["seriesFingerprint"]).toBeInstanceOf(Includes);
+    expect((query["seriesFingerprint"] as Includes).values).toEqual([
+      "fp-1",
+      "fp-2",
+    ]);
+    expect(query["currentAlertState"]).toEqual({ isResolvedState: false });
+  });
+
+  test("creates only for fingerprints without an open alert, carrying the match fields", async () => {
+    const open: Alert = new Alert();
+    open.seriesFingerprint = "fp-1";
+    alertFindSpy.mockResolvedValue([open] as never);
+
+    const created: number = await openDedupedAlerts({
+      projectId: PROJECT_ID,
+      alertSeverityId: SEVERITY_ID,
+      logLabel: "test",
+      matches: [buildMatch("fp-1"), buildMatch("fp-2")],
+    });
+
+    expect(created).toBe(1);
+    expect(alertCreateSpy).toHaveBeenCalledTimes(1);
+
+    const alert: Alert = (alertCreateSpy.mock.calls[0]![0] as JSONObject)[
+      "data"
+    ] as Alert;
+    expect(alert.seriesFingerprint).toBe("fp-2");
+    expect(alert.title).toBe("title for fp-2");
+    expect(alert.alertSeverityId).toBe(SEVERITY_ID);
+    expect(alert.isCreatedAutomatically).toBe(true);
+    expect(alert.rootCause).toBe("the source matched");
+  });
+
+  test("one failing create does not sink the batch", async () => {
+    alertCreateSpy
+      .mockRejectedValueOnce(new Error("privacy hook exploded") as never)
+      .mockResolvedValueOnce(new Alert() as never);
+
+    const created: number = await openDedupedAlerts({
+      projectId: PROJECT_ID,
+      alertSeverityId: SEVERITY_ID,
+      logLabel: "test",
+      matches: [buildMatch("fp-1"), buildMatch("fp-2")],
+    });
+
+    expect(created).toBe(1);
+    expect(alertCreateSpy).toHaveBeenCalledTimes(2);
+    expect(logger.error).toHaveBeenCalled();
+  });
+});
+
+describe("openDedupedIncidents", () => {
+  test("the incident twin dedupes against unresolved incidents and creates guarded", async () => {
+    const open: Incident = new Incident();
+    open.seriesFingerprint = "fp-1";
+    incidentFindSpy.mockResolvedValue([open] as never);
+
+    const created: number = await openDedupedIncidents({
+      projectId: PROJECT_ID,
+      incidentSeverityId: SEVERITY_ID,
+      logLabel: "test",
+      matches: [buildMatch("fp-1"), buildMatch("fp-2")],
+    });
+
+    expect(created).toBe(1);
+
+    const query: JSONObject = (incidentFindSpy.mock.calls[0]![0] as JSONObject)[
+      "query"
+    ] as JSONObject;
+    expect(query["currentIncidentState"]).toEqual({ isResolvedState: false });
+
+    const incident: Incident = (
+      incidentCreateSpy.mock.calls[0]![0] as JSONObject
+    )["data"] as Incident;
+    expect(incident.seriesFingerprint).toBe("fp-2");
+    expect(incident.incidentSeverityId).toBe(SEVERITY_ID);
+  });
+});
+
+describe("pickSeverityByPrecedence", () => {
+  type TestSeverity = { id?: ObjectID; name?: string };
+
+  function severity(idText: string, name: string): TestSeverity {
+    return { id: new ObjectID(idText), name };
+  }
+
+  // Sorted by order ascending: most severe first, per the model convention.
+  const SEVERITIES: Array<TestSeverity> = [
+    severity("aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "Critical"),
+    severity("bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", "High"),
+    severity("cccccccc-cccc-4ccc-8ccc-cccccccccccc", "Low"),
+  ];
+
+  test("an explicit id that belongs to the project wins", () => {
+    expect(
+      pickSeverityByPrecedence({
+        severities: SEVERITIES,
+        explicitSeverityId: SEVERITIES[2]!.id,
+        severityLabel: "Critical",
+        isSevere: true,
+      })?.toString(),
+    ).toBe(SEVERITIES[2]!.id!.toString());
+  });
+
+  test("a stale explicit id falls through to the name match, case-insensitively", () => {
+    expect(
+      pickSeverityByPrecedence({
+        severities: SEVERITIES,
+        explicitSeverityId: new ObjectID(
+          "99999999-9999-4999-8999-999999999999",
+        ),
+        severityLabel: "high",
+        isSevere: true,
+      })?.toString(),
+    ).toBe(SEVERITIES[1]!.id!.toString());
+  });
+
+  test("no name match ranks: severe labels to the most severe, others to the least", () => {
+    expect(
+      pickSeverityByPrecedence({
+        severities: SEVERITIES,
+        explicitSeverityId: undefined,
+        severityLabel: "Sev0",
+        isSevere: true,
+      })?.toString(),
+    ).toBe(SEVERITIES[0]!.id!.toString());
+
+    expect(
+      pickSeverityByPrecedence({
+        severities: SEVERITIES,
+        explicitSeverityId: undefined,
+        severityLabel: "Informational",
+        isSevere: false,
+      })?.toString(),
+    ).toBe(SEVERITIES[2]!.id!.toString());
+  });
+
+  test("no severities at all resolves to null — the caller skips creation", () => {
+    expect(
+      pickSeverityByPrecedence({
+        severities: [],
+        explicitSeverityId: SEVERITY_ID,
+        severityLabel: "High",
+        isSevere: true,
+      }),
+    ).toBeNull();
+  });
+});

package/Tests/Server/Utils/SecurityEvent/ThreatIntel/TaxiiClient.test.ts

@@ -0,0 +1,282 @@
+import TaxiiClient, {
+  TAXII_DATE_ADDED_LAST_HEADER,
+  TAXII_MEDIA_TYPE,
+  TaxiiObjectsPage,
+} from "../../../../../Server/Utils/SecurityEvent/ThreatIntel/TaxiiClient";
+import {
+  DataSourceHttpRequest,
+  DataSourceHttpResponse,
+} from "../../../../../Server/Utils/DataSource/HttpFetch";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../../../Types/JSON";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The TAXII 2.1 client contract: request construction (URL, media type,
+ * auth precedence) and envelope/header parsing — everything the poller
+ * depends on but cannot see from its own call site. The transport is the
+ * injected seam, so these tests exercise the real code against fixtures
+ * with no network and no DNS.
+ */
+
+const API_ROOT: string = "https://taxii.example.com/api1/";
+const COLLECTION_ID: string = "91a7b528-80eb-42ed-a74d-c6fbd5a26116";
+
+interface CapturedRequest {
+  request: DataSourceHttpRequest | null;
+}
+
+function buildClient(options: {
+  apiToken?: string;
+  basicAuthUsername?: string;
+  basicAuthPassword?: string;
+  apiRootUrl?: string;
+  response?: Partial<DataSourceHttpResponse>;
+  captured?: CapturedRequest;
+}): TaxiiClient {
+  return new TaxiiClient({
+    apiRootUrl: options.apiRootUrl || API_ROOT,
+    collectionId: COLLECTION_ID,
+    apiToken: options.apiToken,
+    basicAuthUsername: options.basicAuthUsername,
+    basicAuthPassword: options.basicAuthPassword,
+    fetchImplementation: (
+      request: DataSourceHttpRequest,
+    ): Promise<DataSourceHttpResponse> => {
+      if (options.captured) {
+        options.captured.request = request;
+      }
+
+      return Promise.resolve({
+        statusCode: 200,
+        bodyText: "",
+        bodyJson: { objects: [], more: false },
+        headers: {},
+        ...options.response,
+      });
+    },
+  });
+}
+
+describe("TaxiiClient — validation", () => {
+  test("accepts http(s) roots and rejects everything else", () => {
+    expect(() => {
+      return TaxiiClient.validateApiRootUrl("https://taxii.example.com/api1/");
+    }).not.toThrow();
+    expect(() => {
+      return TaxiiClient.validateApiRootUrl("http://taxii.internal:9000/root");
+    }).not.toThrow();
+
+    expect(() => {
+      return TaxiiClient.validateApiRootUrl("not a url");
+    }).toThrow(BadDataException);
+    expect(() => {
+      return TaxiiClient.validateApiRootUrl("ftp://taxii.example.com/");
+    }).toThrow(BadDataException);
+    expect(() => {
+      return TaxiiClient.validateApiRootUrl(
+        "https://taxii.example.com/api1/?next=abc",
+      );
+    }).toThrow(BadDataException);
+    expect(() => {
+      return TaxiiClient.validateApiRootUrl("");
+    }).toThrow(BadDataException);
+  });
+
+  test("collection ids are plain identifiers — no slashes, no spaces", () => {
+    expect(() => {
+      return TaxiiClient.validateCollectionId(COLLECTION_ID);
+    }).not.toThrow();
+    expect(() => {
+      return TaxiiClient.validateCollectionId("collection_1.v2-x~y");
+    }).not.toThrow();
+
+    expect(() => {
+      return TaxiiClient.validateCollectionId("");
+    }).toThrow(BadDataException);
+    expect(() => {
+      return TaxiiClient.validateCollectionId("a/b");
+    }).toThrow(BadDataException);
+    expect(() => {
+      return TaxiiClient.validateCollectionId("a b");
+    }).toThrow(BadDataException);
+    expect(() => {
+      return TaxiiClient.validateCollectionId("a?b=c");
+    }).toThrow(BadDataException);
+  });
+});
+
+describe("TaxiiClient — request construction", () => {
+  test("builds the objects URL with match[type]=indicator, limit, added_after and next", () => {
+    const client: TaxiiClient = buildClient({});
+
+    const url: string = client.buildObjectsUrl({
+      limit: 500,
+      addedAfter: "2026-08-01T00:00:00.000Z",
+      next: "page-2-token",
+    });
+
+    expect(url).toContain(
+      `https://taxii.example.com/api1/collections/${COLLECTION_ID}/objects/?`,
+    );
+    expect(url).toContain("limit=500");
+    expect(url).toContain("added_after=2026-08-01T00%3A00%3A00.000Z");
+    expect(url).toContain("next=page-2-token");
+    // URLSearchParams percent-encodes the brackets; the server decodes them.
+    expect(url).toContain("match%5Btype%5D=indicator");
+  });
+
+  test("a root without a trailing slash gets one — the collection path never fuses onto the root", () => {
+    const client: TaxiiClient = buildClient({
+      apiRootUrl: "https://taxii.example.com/api1",
+    });
+
+    expect(client.buildObjectsUrl({ limit: 10 })).toContain(
+      "/api1/collections/",
+    );
+  });
+
+  test("sends the TAXII 2.1 media type on every request", async () => {
+    const captured: CapturedRequest = { request: null };
+    const client: TaxiiClient = buildClient({ captured });
+
+    await client.fetchIndicatorObjects({ limit: 10 });
+
+    expect(captured.request?.headers?.["Accept"]).toBe(TAXII_MEDIA_TYPE);
+    expect(captured.request?.method).toBe("GET");
+    expect(captured.request?.timeoutInMs).toBeGreaterThan(0);
+  });
+
+  test("anonymous collections send no Authorization header", async () => {
+    const captured: CapturedRequest = { request: null };
+    const client: TaxiiClient = buildClient({ captured });
+
+    await client.fetchIndicatorObjects({ limit: 10 });
+
+    expect(captured.request?.headers?.["Authorization"]).toBeUndefined();
+  });
+
+  test("an API token becomes a Bearer header and wins over basic auth", async () => {
+    const captured: CapturedRequest = { request: null };
+    const client: TaxiiClient = buildClient({
+      captured,
+      apiToken: "secret-token",
+      basicAuthUsername: "alice",
+      basicAuthPassword: "hunter2",
+    });
+
+    await client.fetchIndicatorObjects({ limit: 10 });
+
+    expect(captured.request?.headers?.["Authorization"]).toBe(
+      "Bearer secret-token",
+    );
+  });
+
+  test("basic-auth credentials become a base64 Basic header", async () => {
+    const captured: CapturedRequest = { request: null };
+    const client: TaxiiClient = buildClient({
+      captured,
+      basicAuthUsername: "alice",
+      basicAuthPassword: "hunter2",
+    });
+
+    await client.fetchIndicatorObjects({ limit: 10 });
+
+    const expected: string = `Basic ${Buffer.from("alice:hunter2").toString(
+      "base64",
+    )}`;
+    expect(captured.request?.headers?.["Authorization"]).toBe(expected);
+  });
+});
+
+describe("TaxiiClient — response parsing", () => {
+  test("parses envelope objects, more, next and the date-added-last header", async () => {
+    const indicator: JSONObject = {
+      type: "indicator",
+      id: "indicator--0001",
+    };
+
+    const client: TaxiiClient = buildClient({
+      response: {
+        bodyJson: {
+          objects: [indicator],
+          more: true,
+          next: "token-2",
+        },
+        headers: {
+          [TAXII_DATE_ADDED_LAST_HEADER]: "2026-08-27T10:00:00.000Z",
+        },
+      },
+    });
+
+    const page: TaxiiObjectsPage = await client.fetchIndicatorObjects({
+      limit: 10,
+    });
+
+    expect(page.objects).toEqual([indicator]);
+    expect(page.more).toBe(true);
+    expect(page.next).toBe("token-2");
+    expect(page.dateAddedLast).toBe("2026-08-27T10:00:00.000Z");
+  });
+
+  test("an envelope with no objects, no more and no header parses to the empty page", async () => {
+    const client: TaxiiClient = buildClient({
+      response: { bodyJson: {} },
+    });
+
+    const page: TaxiiObjectsPage = await client.fetchIndicatorObjects({
+      limit: 10,
+    });
+
+    expect(page.objects).toEqual([]);
+    expect(page.more).toBe(false);
+    expect(page.next).toBeNull();
+    expect(page.dateAddedLast).toBeNull();
+  });
+
+  test("non-object entries inside objects are dropped, not crashed on", async () => {
+    const client: TaxiiClient = buildClient({
+      response: {
+        bodyJson: {
+          objects: [{ type: "indicator", id: "x" }, "garbage", 42, null, []],
+        },
+      },
+    });
+
+    const page: TaxiiObjectsPage = await client.fetchIndicatorObjects({
+      limit: 10,
+    });
+
+    expect(page.objects).toEqual([{ type: "indicator", id: "x" }]);
+  });
+
+  test("a response with headers missing entirely still parses (older transports)", async () => {
+    const client: TaxiiClient = buildClient({
+      response: { bodyJson: { objects: [] }, headers: undefined },
+    });
+
+    const page: TaxiiObjectsPage = await client.fetchIndicatorObjects({
+      limit: 10,
+    });
+
+    expect(page.dateAddedLast).toBeNull();
+  });
+
+  test("a non-envelope body is an error, not an empty page — silence would look like a drained feed", async () => {
+    const clientArray: TaxiiClient = buildClient({
+      response: { bodyJson: ["not", "an", "envelope"] },
+    });
+
+    await expect(
+      clientArray.fetchIndicatorObjects({ limit: 10 }),
+    ).rejects.toThrow(BadDataException);
+
+    const clientText: TaxiiClient = buildClient({
+      response: { bodyJson: undefined, bodyText: "<html>login</html>" },
+    });
+
+    await expect(
+      clientText.fetchIndicatorObjects({ limit: 10 }),
+    ).rejects.toThrow(BadDataException);
+  });
+});