@oneuptime/common 12.0.24 → 12.0.26

package/Tests/Models/DatabaseModels/ResourceFeedModels.test.ts

@@ -0,0 +1,398 @@
+import AllModelTypes from "../../../Models/DatabaseModels/Index";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Permission, {
+  PermissionHelper,
+  PermissionProps,
+} from "../../../Types/Permission";
+import CephClusterFeed, {
+  CephClusterFeedEventType,
+} from "../../../Models/DatabaseModels/CephClusterFeed";
+import CloudResourceFeed, {
+  CloudResourceFeedEventType,
+} from "../../../Models/DatabaseModels/CloudResourceFeed";
+import DockerHostFeed, {
+  DockerHostFeedEventType,
+} from "../../../Models/DatabaseModels/DockerHostFeed";
+import DockerSwarmClusterFeed, {
+  DockerSwarmClusterFeedEventType,
+} from "../../../Models/DatabaseModels/DockerSwarmClusterFeed";
+import HostFeed, {
+  HostFeedEventType,
+} from "../../../Models/DatabaseModels/HostFeed";
+import KubernetesClusterFeed, {
+  KubernetesClusterFeedEventType,
+} from "../../../Models/DatabaseModels/KubernetesClusterFeed";
+import PodmanHostFeed, {
+  PodmanHostFeedEventType,
+} from "../../../Models/DatabaseModels/PodmanHostFeed";
+import ProxmoxClusterFeed, {
+  ProxmoxClusterFeedEventType,
+} from "../../../Models/DatabaseModels/ProxmoxClusterFeed";
+import ServiceFeed, {
+  ServiceFeedEventType,
+} from "../../../Models/DatabaseModels/ServiceFeed";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Nine infrastructure and catalog resources gained an activity feed at once -
+ * Kubernetes clusters, Docker and Podman hosts, Docker Swarm / Proxmox / Ceph
+ * clusters, servers, cloud resources and catalog services. They were generated
+ * from one template, which is exactly why they need a sweep rather than nine
+ * hand-written assertions: a template applied nine times fails in the same
+ * place nine times, and a tenth resource added later by hand will not match it
+ * at all.
+ *
+ * The properties pinned here are the ones that are invisible until they are
+ * wrong in production:
+ *
+ *   - registration in Models/Index.ts, without which the table is never created
+ *   - a UNIQUE CRUD route, because a duplicate silently shadows another model
+ *   - tenant scoping, so one project cannot read another's history
+ *   - read access that follows the parent resource, so a feed cannot leak the
+ *     existence of a resource the caller may not see
+ *   - an append-only access shape: nothing may update or delete a feed row
+ */
+
+type ModelType = { new (): BaseModel };
+
+interface FeedModelSpec {
+  name: string;
+  modelType: ModelType;
+  /** Relation property the read check follows (CanAccessIfCanReadOn). */
+  relationProperty: string;
+  /** Foreign key column back to the resource. */
+  foreignKeyColumn: string;
+  /** Column holding the event type. */
+  eventTypeColumn: string;
+  crudApiPath: string;
+  eventTypeEnum: Record<string, string>;
+  /** Members every one of these enums must carry, resource-specific ones aside. */
+  sharedEventTypes: Array<string>;
+  resourceEventTypes: Array<string>;
+}
+
+const FEED_MODELS: Array<FeedModelSpec> = [
+  {
+    name: "KubernetesClusterFeed",
+    modelType: KubernetesClusterFeed,
+    relationProperty: "kubernetesCluster",
+    foreignKeyColumn: "kubernetesClusterId",
+    eventTypeColumn: "kubernetesClusterFeedEventType",
+    crudApiPath: "/kubernetes-cluster-feed",
+    eventTypeEnum: KubernetesClusterFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "KubernetesClusterCreated",
+      "KubernetesClusterUpdated",
+      "KubernetesClusterArchived",
+      "KubernetesClusterRestored",
+    ],
+  },
+  {
+    name: "DockerHostFeed",
+    modelType: DockerHostFeed,
+    relationProperty: "dockerHost",
+    foreignKeyColumn: "dockerHostId",
+    eventTypeColumn: "dockerHostFeedEventType",
+    crudApiPath: "/docker-host-feed",
+    eventTypeEnum: DockerHostFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "DockerHostCreated",
+      "DockerHostUpdated",
+      "DockerHostArchived",
+      "DockerHostRestored",
+    ],
+  },
+  {
+    name: "DockerSwarmClusterFeed",
+    modelType: DockerSwarmClusterFeed,
+    relationProperty: "dockerSwarmCluster",
+    foreignKeyColumn: "dockerSwarmClusterId",
+    eventTypeColumn: "dockerSwarmClusterFeedEventType",
+    crudApiPath: "/docker-swarm-cluster-feed",
+    eventTypeEnum: DockerSwarmClusterFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "DockerSwarmClusterCreated",
+      "DockerSwarmClusterUpdated",
+      "DockerSwarmClusterArchived",
+      "DockerSwarmClusterRestored",
+    ],
+  },
+  {
+    name: "CephClusterFeed",
+    modelType: CephClusterFeed,
+    relationProperty: "cephCluster",
+    foreignKeyColumn: "cephClusterId",
+    eventTypeColumn: "cephClusterFeedEventType",
+    crudApiPath: "/ceph-cluster-feed",
+    eventTypeEnum: CephClusterFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "CephClusterCreated",
+      "CephClusterUpdated",
+      "CephClusterArchived",
+      "CephClusterRestored",
+    ],
+  },
+  {
+    name: "PodmanHostFeed",
+    modelType: PodmanHostFeed,
+    relationProperty: "podmanHost",
+    foreignKeyColumn: "podmanHostId",
+    eventTypeColumn: "podmanHostFeedEventType",
+    crudApiPath: "/podman-host-feed",
+    eventTypeEnum: PodmanHostFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "PodmanHostCreated",
+      "PodmanHostUpdated",
+      "PodmanHostArchived",
+      "PodmanHostRestored",
+    ],
+  },
+  {
+    name: "ProxmoxClusterFeed",
+    modelType: ProxmoxClusterFeed,
+    relationProperty: "proxmoxCluster",
+    foreignKeyColumn: "proxmoxClusterId",
+    eventTypeColumn: "proxmoxClusterFeedEventType",
+    crudApiPath: "/proxmox-cluster-feed",
+    eventTypeEnum: ProxmoxClusterFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "ProxmoxClusterCreated",
+      "ProxmoxClusterUpdated",
+      "ProxmoxClusterArchived",
+      "ProxmoxClusterRestored",
+    ],
+  },
+  {
+    name: "HostFeed",
+    modelType: HostFeed,
+    relationProperty: "host",
+    foreignKeyColumn: "hostId",
+    eventTypeColumn: "hostFeedEventType",
+    crudApiPath: "/host-feed",
+    eventTypeEnum: HostFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "HostCreated",
+      "HostUpdated",
+      "HostArchived",
+      "HostRestored",
+    ],
+  },
+  {
+    name: "CloudResourceFeed",
+    modelType: CloudResourceFeed,
+    relationProperty: "cloudResource",
+    foreignKeyColumn: "cloudResourceId",
+    eventTypeColumn: "cloudResourceFeedEventType",
+    crudApiPath: "/cloud-resource-feed",
+    eventTypeEnum: CloudResourceFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "CloudResourceCreated",
+      "CloudResourceUpdated",
+      "CloudResourceArchived",
+      "CloudResourceRestored",
+    ],
+  },
+  {
+    name: "ServiceFeed",
+    modelType: ServiceFeed,
+    relationProperty: "service",
+    foreignKeyColumn: "serviceId",
+    eventTypeColumn: "serviceFeedEventType",
+    crudApiPath: "/service-feed",
+    eventTypeEnum: ServiceFeedEventType,
+    sharedEventTypes: [],
+    resourceEventTypes: [
+      "ServiceCreated",
+      "ServiceUpdated",
+      "ServiceArchived",
+      "ServiceRestored",
+    ],
+  },
+];
+
+/** Owner and rule events every one of these feeds records. */
+const SHARED_EVENT_TYPES: Array<string> = [
+  "OwnerUserAdded",
+  "OwnerUserRemoved",
+  "OwnerTeamAdded",
+  "OwnerTeamRemoved",
+  "OwnerRuleExecuted",
+  "LabelRuleExecuted",
+];
+
+const MODEL_TYPES: Array<ModelType> = AllModelTypes as Array<ModelType>;
+
+const PERMISSION_PROPS: Array<PermissionProps> =
+  PermissionHelper.getAllPermissionProps();
+
+function permissionExists(permission: Permission): boolean {
+  return PERMISSION_PROPS.some((props: PermissionProps) => {
+    return props.permission === permission;
+  });
+}
+
+describe("Resource activity feed models", () => {
+  test("the inventory is not empty", () => {
+    // Guards every test.each below against passing on an empty list.
+    expect(FEED_MODELS.length).toBe(9);
+  });
+
+  test.each(FEED_MODELS)(
+    "$name is registered in Models/Index.ts",
+    (spec: FeedModelSpec) => {
+      /*
+       * Boot-time createTables() iterates that array. A model missing from it
+       * type-checks, imports fine, and simply has no table in Postgres.
+       */
+      expect(MODEL_TYPES).toContain(spec.modelType);
+    },
+  );
+
+  test("each feed claims its own CRUD route", () => {
+    const paths: Array<string> = FEED_MODELS.map((spec: FeedModelSpec) => {
+      const model: BaseModel = new spec.modelType();
+      return model.getCrudApiPath()!.toString();
+    });
+
+    expect(paths.sort()).toEqual(
+      FEED_MODELS.map((spec: FeedModelSpec) => {
+        return spec.crudApiPath;
+      }).sort(),
+    );
+    expect(new Set(paths).size).toBe(paths.length);
+  });
+
+  test("no feed route collides with an existing model's route", () => {
+    const routeCounts: Map<string, number> = new Map<string, number>();
+
+    for (const modelType of MODEL_TYPES) {
+      const path: string | undefined = new modelType()
+        .getCrudApiPath()
+        ?.toString();
+
+      if (!path) {
+        continue;
+      }
+
+      routeCounts.set(path, (routeCounts.get(path) || 0) + 1);
+    }
+
+    for (const spec of FEED_MODELS) {
+      expect(routeCounts.get(spec.crudApiPath)).toBe(1);
+    }
+  });
+
+  test.each(FEED_MODELS)(
+    "$name is scoped to a project and inherits read access from its resource",
+    (spec: FeedModelSpec) => {
+      const model: BaseModel = new spec.modelType();
+
+      expect(model.getTenantColumn()).toBe("projectId");
+
+      /*
+       * Without this the feed is readable by anyone holding the feed
+       * permission, including for resources they cannot see - which leaks
+       * both the resource's existence and its owners.
+       */
+      expect(model.canAccessIfCanReadOn).toBe(spec.relationProperty);
+
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const ownedThrough: any = (model as any).ownedThrough;
+      expect(ownedThrough).toBeTruthy();
+      expect(ownedThrough.fkColumn).toBe(spec.foreignKeyColumn);
+      expect(ownedThrough.parentModels.length).toBe(1);
+    },
+  );
+
+  test.each(FEED_MODELS)("$name is append only", (spec: FeedModelSpec) => {
+    const model: BaseModel = new spec.modelType();
+
+    /*
+     * A feed that can be edited or deleted is not a record of what happened,
+     * it is a record of what somebody last wanted it to say.
+     */
+    expect(model.getUpdatePermissions()).toEqual([]);
+    expect(model.getDeletePermissions()).toEqual([]);
+    expect(model.getCreatePermissions().length).toBeGreaterThan(0);
+    expect(model.getReadPermissions().length).toBeGreaterThan(0);
+  });
+
+  test.each(FEED_MODELS)(
+    "$name gates itself on its own granular permissions, which exist in the catalogue",
+    (spec: FeedModelSpec) => {
+      const model: BaseModel = new spec.modelType();
+      const resourceName: string = spec.name.replace(/Feed$/, "");
+
+      const createPermission: Permission =
+        `Create${resourceName}Feed` as Permission;
+      const readPermission: Permission =
+        `Read${resourceName}Feed` as Permission;
+      const editPermission: Permission =
+        `Edit${resourceName}Feed` as Permission;
+
+      expect(model.getCreatePermissions()).toContain(createPermission);
+      expect(model.getReadPermissions()).toContain(readPermission);
+
+      /*
+       * A permission a model gates on but the catalogue does not list cannot
+       * be granted to anybody, so the gate is closed forever.
+       */
+      expect(permissionExists(createPermission)).toBe(true);
+      expect(permissionExists(readPermission)).toBe(true);
+      expect(permissionExists(editPermission)).toBe(true);
+    },
+  );
+
+  test.each(FEED_MODELS)(
+    "$name records who acted and when, not just what happened",
+    (spec: FeedModelSpec) => {
+      const model: BaseModel = new spec.modelType();
+      const columns: Array<string> = model.getTableColumns().columns;
+
+      for (const column of [
+        "projectId",
+        spec.foreignKeyColumn,
+        "feedInfoInMarkdown",
+        "moreInformationInMarkdown",
+        spec.eventTypeColumn,
+        "displayColor",
+        "userId",
+        "postedAt",
+      ]) {
+        expect(columns).toContain(column);
+      }
+    },
+  );
+
+  test.each(FEED_MODELS)(
+    "$name carries the owner and rule events plus its own lifecycle events",
+    (spec: FeedModelSpec) => {
+      const members: Array<string> = Object.values(spec.eventTypeEnum);
+
+      for (const shared of SHARED_EVENT_TYPES) {
+        expect(members).toContain(shared);
+      }
+
+      for (const own of spec.resourceEventTypes) {
+        expect(members).toContain(own);
+      }
+
+      /*
+       * Enum values are stored verbatim in a ShortText column, so a member
+       * whose value drifts from its key silently orphans every row already
+       * written under the old value.
+       */
+      for (const [key, value] of Object.entries(spec.eventTypeEnum)) {
+        expect(value).toBe(key);
+      }
+    },
+  );
+});

package/Tests/Models/DiscoveryScanNameColumn.test.ts

@@ -208,7 +208,7 @@ describe("NetworkDeviceDiscoveryScan.name access control", () => {
   });
 
   /*
-   * The Rename dialog on the Discovery page depends on this list being
+   * The Edit dialog on the Discovery page depends on this list being
    * non-empty — ModelForm drops a field whose column grants no update
    * permission, so an empty list here would turn the dialog into a permission
    * error rather than a text box.
@@ -221,22 +221,54 @@ describe("NetworkDeviceDiscoveryScan.name access control", () => {
   });
 
   /*
-   * And the sweep itself stays read-only. This is the claim worth pinning:
-   * adding an editable column must not have made anything that DESCRIBES a
-   * sweep editable with it. A target or a credential changed after a probe
-   * took the scan would leave the stored row describing a sweep that never
-   * ran, and a status or a result changed by hand would be a lie about one
-   * that did.
+   * THE LINE THIS MODEL IS DIVIDED ALONG, and the reason both halves are
+   * pinned here rather than left to whoever edits the model next.
    *
-   * (The recurrence pair is editable, and always was — it describes the NEXT
-   * run rather than the one that happened.)
+   * Everything that DESCRIBES the scan is editable. That is a reversal: every
+   * one of these columns was create-only until OneUptime issue #3444, on the
+   * reasoning that a row must never stop describing the sweep that ran. The
+   * reasoning was right and the conclusion was wrong — it made a typo'd subnet
+   * or a rejected community string unfixable except by deleting the scan and
+   * losing its results. The invariant now lives in
+   * NetworkDeviceDiscoveryScanService instead: changing any of them re-queues
+   * the scan and clears the previous run.
+   *
+   * Everything the scan REPORTED stays read-only, and that half is
+   * load-bearing. The service writes those columns as root through the
+   * hook-free path, which has no column access control at all, so this list is
+   * the only thing standing between the public CRUD API and a hand-edited
+   * result: a scan that claims to have found hosts it never saw.
    */
-  test("does not make any part of the sweep editable", () => {
+  test("makes every setting of the sweep editable", () => {
     const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
 
-    const sweepColumns: Array<string> = [
+    const settingColumns: Array<string> = [
       "cidr",
+      // Both spellings: the dashboard posts `probe`, API clients post `probeId`.
+      "probe",
       "probeId",
+      /*
+       * The scan's METHOD belongs with the settings it governs (issue #3445):
+       * it decides whether the probe sends SNMP at all, so an operator who can
+       * edit the credentials must be able to edit whether they are used — and
+       * the service clears those credentials to null when the method goes off,
+       * so the two can never disagree on a stored row.
+       */
+      "isSnmpEnabled",
+      /*
+       * The ordered credential list (issue #3458) is a SETTING of the sweep,
+       * not something the scan reported, so it belongs on this side of the
+       * line — and it has to be here specifically because the Edit dialog
+       * renders it: ModelForm drops a field whose column grants no update
+       * permission, so a create-only `snmpConfigs` would leave the operator
+       * an editor that silently cannot save the one thing it edits.
+       *
+       * It is also the column the method above CLEARS. A method that is
+       * editable while the credentials it governs are not would give the
+       * service an update it cannot honour: turning SNMP off has to null this
+       * list, and a create-only column cannot be nulled by an update.
+       */
+      "snmpConfigs",
       "snmpVersion",
       "snmpCommunityString",
       "snmpPort",
@@ -246,6 +278,23 @@ describe("NetworkDeviceDiscoveryScan.name access control", () => {
       "snmpV3AuthKey",
       "snmpV3PrivProtocol",
       "snmpV3PrivKey",
+      // The pair that describes the NEXT run rather than the one that happened.
+      "isRecurring",
+      "rescanIntervalInMinutes",
+    ];
+
+    for (const column of settingColumns) {
+      expect({
+        column: column,
+        update: scan.getColumnAccessControlFor(column)?.update,
+      }).toEqual({ column: column, update: EDITORS });
+    }
+  });
+
+  test("keeps everything the scan reported read-only", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+
+    const resultColumns: Array<string> = [
       "status",
       "statusMessage",
       "discoveredDevices",
@@ -253,26 +302,112 @@ describe("NetworkDeviceDiscoveryScan.name access control", () => {
       "respondedHostCount",
       "startedAt",
       "completedAt",
+      // Derived by the server from the schedule; never set by hand.
       "nextScanAt",
+      "autoImportProcessedAt",
     ];
 
-    for (const column of sweepColumns) {
+    for (const column of resultColumns) {
       expect({
         column: column,
         update: scan.getColumnAccessControlFor(column)?.update,
       }).toEqual({ column: column, update: [] });
     }
+
+    /*
+     * And the column that looks like it belongs on this side but must not be
+     * moved here. `snmpConfigs` holds community strings and v3 passphrases,
+     * so the instinct on reading it is to lock it down beside the results —
+     * but it is the operator's own input, not something the scan reported,
+     * and an empty update list is precisely what makes a column unsavable
+     * from the Edit dialog. Its secrets are guarded by a narrow READ list
+     * instead, which the test below pins.
+     *
+     * Asserted in both directions so the two halves of this divide cannot be
+     * quietly edited into agreeing with each other: the name is absent from
+     * the list AND the model really does grant updates on it.
+     */
+    expect(resultColumns).not.toContain("snmpConfigs");
+    expect(scan.getColumnAccessControlFor("snmpConfigs")?.update).not.toEqual(
+      [],
+    );
   });
 
-  // ...while the two columns that describe a future run stay editable.
-  test("leaves the recurrence pair editable, as it already was", () => {
+  /*
+   * Widening `update` must not have widened `read`. The credential columns are
+   * read by a narrower list than the rest of the model on purpose — a
+   * passphrase is not something every reader of the scans list should be
+   * handed — and every editor is already inside it, so the Edit dialog can
+   * still prefill them.
+   *
+   * `snmpConfigs` is the fourth, and the one most easily got wrong. It is a
+   * jsonb column, so it has ONE permission for the whole value, and the value
+   * contains the community strings and v3 passphrases of every credential set
+   * the scan tries. A jsonb column therefore has to take the STRICTEST of the
+   * permissions of what it contains: granting it the model's usual read list
+   * would hand a Viewer, in one array, every secret the three flattened
+   * columns beside it are narrowed to keep from them.
+   */
+  test("does not widen read access to the credentials", () => {
     const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
 
-    for (const column of ["isRecurring", "rescanIntervalInMinutes"]) {
-      expect(scan.getColumnAccessControlFor(column)?.update).toEqual(EDITORS);
+    const credentialColumns: Array<string> = [
+      "snmpConfigs",
+      "snmpCommunityString",
+      "snmpV3AuthKey",
+      "snmpV3PrivKey",
+    ];
+
+    for (const column of credentialColumns) {
+      const readers: Array<Permission> =
+        scan.getColumnAccessControlFor(column)?.read || [];
+
+      expect(readers).not.toContain(Permission.Viewer);
+      expect(readers).not.toContain(Permission.SettingsViewer);
+
+      for (const editor of EDITORS) {
+        if (editor === Permission.EditNetworkDeviceDiscoveryScan) {
+          continue;
+        }
+
+        expect(readers).toContain(editor);
+      }
     }
   });
 
+  /*
+   * The other half of that divide, and the place the two changes that landed
+   * together are easiest to confuse for one another.
+   *
+   * `isSnmpEnabled` (issue #3445) and `snmpConfigs` (issue #3458) arrived on
+   * this model at the same time and sit beside each other on the sweep, so the
+   * temptation on reading them is to give them one permission set. They must
+   * not have one: the METHOD is a boolean saying which question the sweep
+   * asked, and every reader of the scans list needs it to tell an ICMP-only
+   * scan from an SNMP one — the results dialog says "Ping only" and explains
+   * why a host has no sysName, and a Viewer who cannot read the flag is shown a
+   * scan that looks broken rather than one that was deliberately narrow. The
+   * CREDENTIALS are passphrases, and no widening of the flag beside them may
+   * drag them along.
+   *
+   * Asserted as exact equality with the model's usual read list rather than
+   * "contains Viewer", so narrowing the flag to the credential list — the
+   * mistake this test exists to catch — fails here instead of silently
+   * emptying a column of the scans table for viewers.
+   */
+  test("lets every reader see the scan's method, without seeing its credentials", () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+
+    expect(scan.getColumnAccessControlFor("isSnmpEnabled")?.read).toEqual(
+      READERS,
+    );
+
+    // And the list it governs is emphatically NOT read by that same set.
+    expect(scan.getColumnAccessControlFor("snmpConfigs")?.read).not.toEqual(
+      READERS,
+    );
+  });
+
   /*
    * Everything the operator can edit has to be something the table itself
    * accepts an update for, or the row-level check refuses the write before the