@oneuptime/common 12.0.25 → 12.0.26

package/Tests/Server/Utils/TwoFactorBackupCodeNotification.test.ts

@@ -0,0 +1,272 @@
+import TwoFactorBackupCodeNotification from "../../../Server/Utils/TwoFactorBackupCodeNotification";
+import MailService from "../../../Server/Services/MailService";
+import UserService from "../../../Server/Services/UserService";
+import DatabaseConfig from "../../../Server/DatabaseConfig";
+import logger from "../../../Server/Utils/Logger";
+import User from "../../../Models/DatabaseModels/User";
+import Email from "../../../Types/Email";
+import EmailTemplateType from "../../../Types/Email/EmailTemplateType";
+import Hostname from "../../../Types/API/Hostname";
+import Protocol from "../../../Types/API/Protocol";
+import ObjectID from "../../../Types/ObjectID";
+import { JSONObject } from "../../../Types/JSON";
+import Dictionary from "../../../Types/Dictionary";
+import { getJestSpyOn } from "../../Spy";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * The out-of-band notice that a set of recovery codes was just created.
+ *
+ * WHY THIS EXISTS, AND WHY IT IS SEPARATE FROM THE ROUTES THAT SEND IT
+ *
+ * Until issue #3382 was fixed, backup codes only came into existence when a
+ * user personally pressed a button on their own profile page, and that route
+ * mailed them about it. Codes are now minted by ENROLMENT instead -- verifying
+ * a first authenticator app, registering a first security key, or completing a
+ * mandated enrolment at sign-in -- which moved the creation of ten sign-in
+ * credentials onto routes that are authenticated by a session or by a password
+ * alone. Somebody holding a stolen session can register a security key of
+ * their own and walk away with the account's recovery codes; somebody holding
+ * a stolen password can complete a mandated enrolment. Neither is prevented by
+ * this mail. Both become VISIBLE to the real owner because of it, at the
+ * address on the account rather than in the browser that did it, which is the
+ * same bargain the regenerate route already struck.
+ *
+ * EVERY ASSERTION BELOW IS A SILENT FAILURE.
+ *
+ *  - the codes must never be in the mail. They are a sign-in credential, and
+ *    mailing them hands the account to whoever later reads the mailbox --
+ *    which is exactly the thing a second factor exists to stop. Nothing about
+ *    the vars bag makes that obvious, so it is asserted directly;
+ *  - the address must come off the ACCOUNT, never from the caller. A caller
+ *    proved which user they are; it did not prove where that user's mail
+ *    should go, and a notice that can be redirected is worth nothing;
+ *  - it must never throw into its caller. Every call site runs inside a
+ *    request whose response carries the only copy of the plaintext codes, so
+ *    an unreachable SMTP server that propagated would destroy the very thing
+ *    the mail is announcing.
+ *
+ * SIBLING FILES: Common/Tests/Server/API/UserTwoFactorBackupCodeAPI.test.ts
+ * owns the "codes were REPLACED" mail on the self-service regenerate route,
+ * which is a different template with different copy; nothing here repeats it.
+ */
+
+const USER_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+
+type SpyLike = ReturnType<typeof getJestSpyOn>;
+
+let sendMailSpy: SpyLike;
+let findOneByIdSpy: SpyLike;
+let loggerErrorSpy: SpyLike;
+
+type StubUserFunction = (email: string | null) => void;
+
+/*
+ * `findOneById` is what reads the address off the account. A null user stands
+ * in for a deleted account, and a user with no email for one that never
+ * verified one -- both reachable, and both must end in silence rather than a
+ * throw.
+ */
+const stubUser: StubUserFunction = (email: string | null): void => {
+  findOneByIdSpy.mockImplementation(async (): Promise<User | null> => {
+    if (email === null) {
+      return null;
+    }
+
+    const user: User = new User();
+    user.id = USER_ID;
+    user.email = new Email(email);
+    return user;
+  });
+};
+
+describe("TwoFactorBackupCodeNotification", () => {
+  beforeEach(() => {
+    sendMailSpy = getJestSpyOn(MailService, "sendMail");
+    sendMailSpy.mockImplementation(async (): Promise<void> => {
+      return;
+    });
+
+    findOneByIdSpy = getJestSpyOn(UserService, "findOneById");
+    stubUser("owner@example.com");
+
+    loggerErrorSpy = getJestSpyOn(logger, "error");
+    loggerErrorSpy.mockImplementation((): void => {
+      return;
+    });
+
+    getJestSpyOn(DatabaseConfig, "getHost").mockImplementation(
+      async (): Promise<Hostname> => {
+        return new Hostname("oneuptime.example.com");
+      },
+    );
+
+    getJestSpyOn(DatabaseConfig, "getHttpProtocol").mockImplementation(
+      async (): Promise<Protocol> => {
+        return Protocol.HTTPS;
+      },
+    );
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("mails the address on the account, not one supplied by the caller", async () => {
+    await TwoFactorBackupCodeNotification.sendCodesCreatedEmail({
+      userId: USER_ID,
+      codeCount: 10,
+    });
+
+    expect(findOneByIdSpy).toHaveBeenCalledTimes(1);
+
+    const lookup: { id: ObjectID; props: JSONObject } = (
+      findOneByIdSpy.mock.calls[0] as Array<{
+        id: ObjectID;
+        props: JSONObject;
+      }>
+    )[0]!;
+
+    expect(lookup.id.toString()).toBe(USER_ID.toString());
+    expect(lookup.props["isRoot"]).toBe(true);
+
+    expect(sendMailSpy).toHaveBeenCalledTimes(1);
+
+    const mail: { toEmail: Email } = (
+      sendMailSpy.mock.calls[0] as Array<{ toEmail: Email }>
+    )[0]!;
+
+    expect(mail.toEmail.toString()).toBe("owner@example.com");
+  });
+
+  test("uses the created template, not the replaced one", async () => {
+    await TwoFactorBackupCodeNotification.sendCodesCreatedEmail({
+      userId: USER_ID,
+      codeCount: 10,
+    });
+
+    const mail: { templateType: EmailTemplateType; subject: string } = (
+      sendMailSpy.mock.calls[0] as Array<{
+        templateType: EmailTemplateType;
+        subject: string;
+      }>
+    )[0]!;
+
+    /*
+     * The regenerate mail tells the reader every code they were holding has
+     * stopped working. Sent to somebody who has just SET UP two factor auth
+     * for the first time, that sentence describes an event that did not happen
+     * and sends them looking for a list they never had.
+     */
+    expect(mail.templateType).toBe(
+      EmailTemplateType.TwoFactorBackupCodesCreated,
+    );
+    expect(mail.templateType).not.toBe(
+      EmailTemplateType.TwoFactorBackupCodesRegenerated,
+    );
+    expect(mail.subject.toLowerCase()).toContain("backup codes");
+  });
+
+  test("never puts a code in the mail", async () => {
+    await TwoFactorBackupCodeNotification.sendCodesCreatedEmail({
+      userId: USER_ID,
+      codeCount: 10,
+    });
+
+    const mail: { vars: Dictionary<string> } = (
+      sendMailSpy.mock.calls[0] as Array<{ vars: Dictionary<string> }>
+    )[0]!;
+
+    /*
+     * Asserted as "the bag holds exactly these four keys" rather than "it does
+     * not hold a `codes` key", because the failure being guarded is somebody
+     * ADDING one -- under any name -- while making the mail more helpful.
+     */
+    expect(Object.keys(mail.vars).sort()).toEqual([
+      "generatedAt",
+      "homeUrl",
+      "newCodeCount",
+      "twoFactorAuthUrl",
+    ]);
+
+    expect(mail.vars["newCodeCount"]).toBe("10");
+  });
+
+  test("links to the page where the owner can replace the set", async () => {
+    await TwoFactorBackupCodeNotification.sendCodesCreatedEmail({
+      userId: USER_ID,
+      codeCount: 10,
+    });
+
+    const mail: { vars: Dictionary<string> } = (
+      sendMailSpy.mock.calls[0] as Array<{ vars: Dictionary<string> }>
+    )[0]!;
+
+    /*
+     * The mail's whole value to somebody who did NOT do this is that the next
+     * click is the one that fixes it. A link to the dashboard root would leave
+     * them hunting through a settings tree while an attacker holds their
+     * recovery codes.
+     */
+    expect(String(mail.vars["twoFactorAuthUrl"])).toContain(
+      "/user-profile/two-factor-auth",
+    );
+    expect(String(mail.vars["twoFactorAuthUrl"])).toContain("https://");
+  });
+
+  test("says nothing when the account has no address to say it to", async () => {
+    stubUser(null);
+
+    await TwoFactorBackupCodeNotification.sendCodesCreatedEmail({
+      userId: USER_ID,
+      codeCount: 10,
+    });
+
+    expect(sendMailSpy).not.toHaveBeenCalled();
+  });
+
+  test("does not throw into the caller when the mail server is unreachable", async () => {
+    sendMailSpy.mockImplementation(async (): Promise<void> => {
+      throw new Error("SMTP unreachable");
+    });
+
+    /*
+     * `notifyCodesCreated` is the shape every call site uses, and it is the
+     * shape that matters: the codes are already written and already on their
+     * way to the user's screen when it runs. A rejection escaping here would
+     * fail the request carrying the only copy of them.
+     */
+    expect(() => {
+      TwoFactorBackupCodeNotification.notifyCodesCreated({
+        userId: USER_ID,
+        codeCount: 10,
+      });
+    }).not.toThrow();
+
+    await new Promise((resolve: (value: void) => void) => {
+      setTimeout(resolve, 0);
+    });
+
+    expect(loggerErrorSpy).toHaveBeenCalled();
+  });
+
+  test("does not throw into the caller when the account lookup fails", async () => {
+    findOneByIdSpy.mockImplementation(async (): Promise<User | null> => {
+      throw new Error("Database not connected");
+    });
+
+    expect(() => {
+      TwoFactorBackupCodeNotification.notifyCodesCreated({
+        userId: USER_ID,
+        codeCount: 10,
+      });
+    }).not.toThrow();
+
+    await new Promise((resolve: (value: void) => void) => {
+      setTimeout(resolve, 0);
+    });
+
+    expect(loggerErrorSpy).toHaveBeenCalled();
+    expect(sendMailSpy).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/VM/VMRunnerPrivateNetworkWiring.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, test } from "@jest/globals";
+import fs from "fs";
+import path from "path";
+
+/*
+ * VMRunner hands the sandbox the host's real axios, so its SSRF guard is the
+ * one thing standing between workflow-authored JavaScript and the internal
+ * network. VMRunnerSsrf.test.ts exercises that guard for real, but it can only
+ * run where the isolated-vm native module loads — so these source-level checks
+ * cover the one detail that behaviour test does not: the guard now takes a
+ * policy argument, and getting that argument's plumbing wrong fails open.
+ *
+ * Two things must hold, and neither is visible from the sandbox:
+ *
+ *  - The runner passes the CALLER's flag, not a literal `true` and not the
+ *    instance configuration it could read itself. It also executes custom code
+ *    monitors inside the Probe, which has no database to resolve a project
+ *    from, so the decision cannot live here.
+ *
+ *  - Absent, the flag is false. A caller that never heard of the option keeps
+ *    the strict policy rather than inheriting whatever was last set.
+ */
+
+const VM_DIR: string = path.join(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  "..",
+  "Server",
+  "Utils",
+  "VM",
+);
+
+const runnerSource: string = fs.readFileSync(
+  path.join(VM_DIR, "VMRunner.ts"),
+  "utf8",
+);
+
+const apiSource: string = fs.readFileSync(
+  path.join(VM_DIR, "VMAPI.ts"),
+  "utf8",
+);
+
+describe("VMRunner — private network policy plumbing", () => {
+  test("the sandbox axios guard is called with the caller's flag", () => {
+    expect(runnerSource).toMatch(
+      /validateWebhookTargetIsSafe\(\s*effectiveUrl,\s*\{[\s\S]{0,600}?allowPrivateNetworkTargets:\s*\n?\s*options\.allowPrivateNetworkRequests === true,/,
+    );
+  });
+
+  /*
+   * "Webhook URL" is the guard's default noun and is wrong for both of this
+   * runner's callers — one is a workflow script, the other is a monitor.
+   */
+  test("the guard is told this is a request, not a webhook", () => {
+    expect(runnerSource).toMatch(/targetLabel:\s*"Request URL"/);
+  });
+
+  /*
+   * The sentence telling an operator how to permit a private target has to
+   * come from the caller: the workflow component's setting lives on the API
+   * server and the probe's lives on the probe, which is usually a different
+   * machine owned by a different person.
+   */
+  test("the refusal hint is passed through from the caller", () => {
+    expect(runnerSource).toMatch(
+      /privateNetworkHint:\s*options\.privateNetworkHint/,
+    );
+    expect(runnerSource).toMatch(
+      /privateNetworkHint\?:\s*string \| undefined;/,
+    );
+  });
+
+  test("there is exactly one call to the guard", () => {
+    /*
+     * A second, unguarded request path inside the runner would be invisible to
+     * every test above — the sandbox would simply have two doors.
+     */
+    const calls: RegExpMatchArray | null = runnerSource.match(
+      /validateWebhookTargetIsSafe\(/g,
+    );
+
+    expect(calls).toHaveLength(1);
+  });
+
+  test("the runner never reads the instance configuration itself", () => {
+    /*
+     * It would work in the App and silently differ in the Probe, where there
+     * is no project to resolve. The policy has to arrive from the caller.
+     */
+    expect(runnerSource).not.toContain("PrivateNetworkWebhookConfig");
+    expect(runnerSource).not.toContain("ProjectService");
+    expect(runnerSource).not.toContain("ALLOW_PRIVATE_NETWORK_WEBHOOKS");
+  });
+
+  test("the option is optional, so an unaware caller gets the strict policy", () => {
+    expect(runnerSource).toMatch(
+      /allowPrivateNetworkRequests\?:\s*boolean \| undefined;/,
+    );
+  });
+
+  test("VMAPI passes both options through rather than dropping them", () => {
+    expect(apiSource).toMatch(
+      /allowPrivateNetworkRequests\?:\s*boolean \| undefined;/,
+    );
+    expect(apiSource).toMatch(/privateNetworkHint\?:\s*string \| undefined;/);
+    // VMAPI forwards `data` wholesale; anything else would silently drop it.
+    expect(apiSource).toContain("return VMRunner.runCodeInSandbox(data);");
+  });
+});

package/Tests/Server/Utils/VendorAssets.test.ts

@@ -13,7 +13,9 @@ import http, { IncomingMessage, Server, createServer } from "http";
 import { AddressInfo } from "net";
 import { createExpressApp } from "../../../Server/Utils/Express";
 import mountVendorAssets, {
+  BrandAssetsPath,
   MountVendorAssetsFunction,
+  OneUptimeLogoUrl,
   VendorAssetsPath,
   VendorAssetsRoute,
   getMermaidDistPath,
@@ -296,6 +298,121 @@ describe("vendored browser assets", () => {
     });
   });
 
+  describe("brand images", () => {
+    /*
+     * https://github.com/OneUptime/oneuptime/issues/3457 - the on-call
+     * acknowledge page and the SSO message page render out of the App
+     * container and asked for /img/3-transparent.svg, which only the Home
+     * container serves. nginx sends "/" to App on every install with billing
+     * off, so the logo 404'd and the page showed a broken image.
+     */
+    test("resolves to a directory that ships with Common", () => {
+      expect(fs.existsSync(BrandAssetsPath)).toBe(true);
+      expect(fs.statSync(BrandAssetsPath).isDirectory()).toBe(true);
+      expect(
+        BrandAssetsPath.endsWith(path.join("Server", "Static", "Brand")),
+      ).toBe(true);
+    });
+
+    test("the logo URL is under the prefix every service mounts", () => {
+      expect(OneUptimeLogoUrl).toBe(
+        "/oneuptime-assets/brand/oneuptime-logo.svg",
+      );
+      expect(OneUptimeLogoUrl.startsWith(`${VendorAssetsRoute}/`)).toBe(true);
+    });
+
+    test("serves the OneUptime logo as an SVG", async () => {
+      const asset: AssetResponse = await getAsset(OneUptimeLogoUrl);
+
+      expect(asset.status).toBe(200);
+      expect(asset.contentType).toContain("image/svg+xml");
+      expect(asset.text).toContain("<svg");
+      expect(asset.body.byteLength).toBeGreaterThan(1000);
+    });
+
+    test("does not answer with the index page", () => {
+      /*
+       * The failure mode that looks like success: a catch-all mounted ahead of
+       * the asset route hands back HTML with a 200, and an <img> pointed at it
+       * still renders broken.
+       */
+      return getAsset(OneUptimeLogoUrl).then((asset: AssetResponse) => {
+        expect(asset.text).not.toBe(INDEX_PAGE);
+        expect(asset.contentType).not.toContain("text/html");
+      });
+    });
+
+    test("is byte-identical to the copy the frontends and Home already ship", () => {
+      /*
+       * Three copies of one file is not ideal, but a logo that silently drifts
+       * between the marketing site and the acknowledge page is worse. This is
+       * the test that says so.
+       */
+      const served: Buffer = fs.readFileSync(
+        path.join(BrandAssetsPath, "oneuptime-logo.svg"),
+      );
+
+      const copies: Array<string> = [
+        path.join(
+          REPOSITORY_ROOT,
+          "Common",
+          "UI",
+          "Images",
+          "logos",
+          "OneUptimeSVG",
+          "3-transparent.svg",
+        ),
+        path.join(
+          REPOSITORY_ROOT,
+          "Home",
+          "Static",
+          "img",
+          "3-transparent.svg",
+        ),
+      ];
+
+      let compared: number = 0;
+
+      for (const copy of copies) {
+        if (!fs.existsSync(copy)) {
+          continue;
+        }
+
+        compared++;
+        expect(fs.readFileSync(copy).equals(served)).toBe(true);
+      }
+
+      expect(compared).toBe(copies.length);
+    });
+
+    test("revalidates rather than caching for a year", async () => {
+      /*
+       * The filename carries no version, unlike tailwind's, so a rebrand must
+       * not be stuck behind a year-old cache entry.
+       */
+      const asset: AssetResponse = await getAsset(OneUptimeLogoUrl);
+
+      expect(asset.cacheControl).toContain("max-age=3600");
+    });
+
+    test("a brand file that does not exist is a 404, not a page", async () => {
+      const asset: AssetResponse = await getAsset(
+        "/oneuptime-assets/brand/no-such-logo.svg",
+      );
+
+      expect(asset.status).toBe(404);
+      expect(asset.text).not.toBe(INDEX_PAGE);
+    });
+
+    test("a path that escapes the brand directory is refused", async () => {
+      const asset: AssetResponse = await getAsset(
+        "/oneuptime-assets/brand/../../package.json",
+      );
+
+      expect(asset.text).not.toContain("@oneuptime/common");
+    });
+  });
+
   describe("fonts", () => {
     test("serves Inter as a woff2", async () => {
       const asset: AssetResponse = await getAsset(

package/Tests/Server/Utils/Workspace/MicrosoftTeamsChannelSend.test.ts

@@ -1052,6 +1052,42 @@ describe("MicrosoftTeamsUtil.sendAdaptiveCardToChannel - roster error translatio
     );
   });
 
+  test("a Graph permission refusal reaches the admin as a named grant, end to end", async () => {
+    /*
+     * The payoff of the whole PermissionDenied split, exercised through the real
+     * send path rather than against the message builder in isolation: Graph
+     * refuses the installed-apps read, the send is still attempted (a refusal is
+     * not a missing install), Microsoft rejects it on the roster, and the
+     * exception an admin actually reads names the one permission that would turn
+     * the guess into an answer.
+     *
+     * Unit-testing the pieces separately leaves this green even if PermissionDenied
+     * were wired to short-circuit at the preflight, which would break both halves.
+     */
+    mockProjectAuth({});
+    mockInstallState(MicrosoftTeamsAppInstallState.PermissionDenied);
+    installFakeBotAdapter({ adapterError: new Error(ROSTER_ERROR_TEXT) });
+
+    let thrown: unknown = undefined;
+    try {
+      await sendCardToChannel({ teamId: TEAM_ID });
+    } catch (err) {
+      thrown = err;
+    }
+
+    const message: string = (thrown as Error).message;
+
+    // The send was attempted: a refusal to answer is not a missing install.
+    expect(message).not.toContain(
+      "The OneUptime app is not installed in the Microsoft Teams team",
+    );
+    // And the admin is told what to grant.
+    expect(message).toContain("TeamsAppInstallation.ReadForTeam.All");
+    expect(message).toContain("admin consent");
+    // Microsoft's raw wording survives the rewrite.
+    expect(message).toContain(ROSTER_ERROR_TEXT);
+  });
+
   test("a STALE local install record is re-checked, and a confirmed removal gets the install instructions", async () => {
     /*
      * The local record let this send skip the preflight, but the app has since
@@ -1449,14 +1485,25 @@ describe("MicrosoftTeamsUtil.getRosterRejectionMessage", () => {
     }
   });
 
-  test("a known install points at a bot id mismatch, not a missing install", () => {
+  test("a known install stops blaming the package and points at the Azure Bot", () => {
+    /*
+     * Graph confirmed a package carrying this deployment's app id is installed,
+     * so the package is no longer the lead suspect. It used to be named anyway,
+     * which read to admins as though the error had not registered what they had
+     * already done. The identifier stays in the text — it is what they compare
+     * against — but the instruction now points somewhere new.
+     */
     const message: string = MicrosoftTeamsUtil.getRosterRejectionMessage({
       channelName: "General",
       installState: MicrosoftTeamsAppInstallState.Installed,
     });
 
     expect(message).toContain("MICROSOFT_TEAMS_APP_CLIENT_ID");
-    expect(message).toContain("the app is installed in this team");
+    expect(message).toContain("probably not the problem");
+    expect(message).toContain("Azure Bot resource");
+    expect(message).not.toContain(
+      "check that the Teams app package was built from this deployment",
+    );
   });
 
   test("an unknown install state still suggests adding the app", () => {
@@ -1658,19 +1705,69 @@ describe("MicrosoftTeamsUtil.isAppInstalledInTeam", () => {
     expect(get).toHaveBeenCalledTimes(2);
   });
 
-  test("a Graph error is Unknown, never NotInstalled", async () => {
+  test("a 403 is PermissionDenied, never NotInstalled", async () => {
     /*
      * The realistic case: a workspace connected before
      * TeamsAppInstallation.ReadForTeam.All was documented gets a 403 here. It
-     * must not be told its app is missing.
+     * must not be told its app is missing — and it is worth separating from a
+     * plain Unknown, because a refusal names the grant that would fix it.
      */
     mockGraph([new HTTPErrorResponse(403, { error: "Forbidden" }, {})]);
 
+    await expect(callIsAppInstalled()).resolves.toBe(
+      MicrosoftTeamsAppInstallState.PermissionDenied,
+    );
+  });
+
+  test("a non-permission Graph error is still Unknown, never NotInstalled", async () => {
+    /*
+     * A 500 is Microsoft failing, not refusing. Reporting it as PermissionDenied
+     * would tell the admin to grant a permission they already have.
+     */
+    mockGraph([
+      new HTTPErrorResponse(500, { error: "Internal Server Error" }, {}),
+    ]);
+
+    await expect(callIsAppInstalled()).resolves.toBe(
+      MicrosoftTeamsAppInstallState.Unknown,
+    );
+  });
+
+  test("a 401 is Unknown, not PermissionDenied — a stale token is not a missing grant", async () => {
+    /*
+     * Graph answers a missing application permission with 403 and reserves 401
+     * for a token it will not accept. getValidAccessToken can hand over a cached
+     * app token without revalidating it when no expiry was stored, so a 401 here
+     * is a live possibility — and telling that admin to grant a Graph permission
+     * would be a confidently wrong answer.
+     */
+    mockGraph([
+      new HTTPErrorResponse(
+        401,
+        { error: { code: "InvalidAuthenticationToken" } },
+        {},
+      ),
+    ]);
+
     await expect(callIsAppInstalled()).resolves.toBe(
       MicrosoftTeamsAppInstallState.Unknown,
     );
   });
 
+  test("an authorization error code is PermissionDenied whatever status carries it", async () => {
+    mockGraph([
+      new HTTPErrorResponse(
+        400,
+        { error: { code: "Authorization_RequestDenied" } },
+        {},
+      ),
+    ]);
+
+    await expect(callIsAppInstalled()).resolves.toBe(
+      MicrosoftTeamsAppInstallState.PermissionDenied,
+    );
+  });
+
   test("a thrown transport error is Unknown", async () => {
     jest.spyOn(API, "get").mockRejectedValue(new Error("socket hang up"));