@oneuptime/common 12.0.26 → 12.0.28

package/Tests/Server/API/SessionReplayAPI.test.ts

@@ -7,6 +7,7 @@ import RumSessionReplayViewService from "../../../Server/Services/RumSessionRepl
 import RumSessionService from "../../../Server/Services/RumSessionService";
 import RumSessionChunkService from "../../../Server/Services/RumSessionChunkService";
 import { Statement } from "../../../Server/Utils/AnalyticsDatabase/Statement";
+import SessionReplayIdentity from "../../../Server/Utils/SessionReplay/SessionReplayIdentity";
 import RumApplication from "../../../Models/DatabaseModels/RumApplication";
 import RumSessionReplayView from "../../../Models/DatabaseModels/RumSessionReplayView";
 import Label from "../../../Models/DatabaseModels/Label";
@@ -1086,6 +1087,196 @@ describe("Session replay playback API", () => {
       expect(query).toContain("timeout_overflow_mode = 'throw'");
     });
 
+    /*
+     * Watching implies listing.
+     *
+     * RumSession's table read ACL contains ReadRumSessionReplayPayload for a
+     * reason it states outright: a role granted only the watch permission
+     * could fetch payloads - the payload routes authorize on it alone - while
+     * being 401'd on the manifest and the list, which is an incoherent grant
+     * rather than a safer one. The list guard did not mirror it, so the
+     * natural support-engineer role ("Watch Session Replays" + "Read RUM
+     * Application") got a permission error on the session list and a silently
+     * missing "Watch what the user saw" card on every exception page.
+     */
+    test("a caller with only the watch permission can still list sessions", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.ReadRumSessionReplayPayload],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      const result: CallResult = await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: { rumApplicationId: applicationAId.toString() },
+      });
+
+      expect(result.deniedWith).toBeUndefined();
+      expect(headerQuerySpy).toHaveBeenCalledTimes(1);
+    });
+
+    test("a Viewer still cannot list sessions", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.Viewer],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      const result: CallResult = await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: { rumApplicationId: applicationAId.toString() },
+      });
+
+      expect(result.deniedWith).toBeInstanceOf(NotAuthorizedException);
+      expect(headerQuerySpy).not.toHaveBeenCalled();
+    });
+
+    /*
+     * The identity filter takes the end-user REFERENCE a person can see in
+     * the list, and the server derives the digest with the same per-project
+     * HMAC the ingest used. It used to take the digest itself - a value
+     * displayed nowhere in the product and computed by no endpoint - so
+     * every input a human could plausibly type returned nothing.
+     */
+    test("an end-user reference is hashed server side before it reaches the query", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        /* Holds the narrower identity permission - see the gate test below. */
+        permissions: [Permission.ProjectOwner],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: {
+          rumApplicationId: applicationAId.toString(),
+          filters: { identifiedUserRef: "jane@example.com" },
+        },
+      });
+
+      const statement: Statement = headerQuerySpy.mock
+        .calls[0]![0] as Statement;
+
+      const expectedKey: string = SessionReplayIdentity.buildUserKey({
+        projectId: projectId,
+        userRef: "jane@example.com",
+      });
+
+      const bound: string = JSON.stringify(statement.query_params);
+
+      /* The raw reference must never reach the query. */
+      expect(bound).not.toContain("jane@example.com");
+      expect(bound).toContain(expectedKey);
+    });
+
+    /*
+     * The identity FILTER is gated by the same ACL as the identity COLUMN.
+     *
+     * Without this, a caller deliberately denied the label could still ask
+     * "does jane@example.com have sessions here" and read every other field
+     * of the answer - a dictionary attack that de-anonymises the list one
+     * candidate at a time, and hands back identifiedUserKey as a stable
+     * pseudonym to join against the route filter. It only became reachable
+     * once the ingest started populating the column; before that the
+     * predicate matched nothing whoever asked.
+     */
+    test("a caller without the identity permission cannot filter by end user", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        /* Can list, deliberately excluded from SESSION_REPLAY_IDENTITY_PERMISSIONS. */
+        permissions: [Permission.TelemetryAdmin],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: {
+          rumApplicationId: applicationAId.toString(),
+          filters: { identifiedUserRef: "jane@example.com" },
+        },
+      });
+
+      const statement: Statement = headerQuerySpy.mock
+        .calls[0]![0] as Statement;
+
+      const expectedKey: string = SessionReplayIdentity.buildUserKey({
+        projectId: projectId,
+        userRef: "jane@example.com",
+      });
+
+      /* Neither the reference nor its digest may reach the query. */
+      const bound: string = JSON.stringify(statement.query_params);
+
+      expect(bound).not.toContain("jane@example.com");
+      expect(bound).not.toContain(expectedKey);
+
+      /*
+       * aggIdentifiedUserKey is always a SELECT alias; what must be absent
+       * is the HAVING predicate over it.
+       */
+      expect(statement.query).not.toContain("aggIdentifiedUserKey =");
+    });
+
+    /*
+     * A filter the server cannot honour must be refused, not dropped. The
+     * silent-drop shape returns the WHOLE project's sessions with a 200 and
+     * gives the caller no way to tell that the person they asked about was
+     * not the one being answered about.
+     */
+    test("an unusable end-user reference is refused, not silently ignored", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.ProjectOwner],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      const result: CallResult = await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: {
+          rumApplicationId: applicationAId.toString(),
+          filters: { identifiedUserRef: "z".repeat(4096) },
+        },
+      });
+
+      expect(result.deniedWith).toBeInstanceOf(BadDataException);
+      expect(headerQuerySpy).not.toHaveBeenCalled();
+    });
+
     test("omits identifiedUserLabel for a caller without the narrower identity permission", async () => {
       const principal: {
         request: JSONObject;
@@ -1263,6 +1454,47 @@ describe("Session replay playback API", () => {
         "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount) > 0",
       );
     });
+
+    /*
+     * `false` means "sessions with NO frustration signals" and must be
+     * honoured, not dropped. The route admits any boolean and hasError /
+     * isFinalized beside it both honour false, so accepting the value and
+     * ignoring it returned the whole unfiltered list with a 200 and no
+     * indication why. The Dashboard never sends it, so this branch has no
+     * producer and this is its only cover.
+     */
+    test("hasFrustration false selects the clean sessions rather than being dropped", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.ProjectAdmin],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: {
+          rumApplicationId: applicationAId.toString(),
+          filters: { hasFrustration: false },
+        },
+      });
+
+      const statement: Statement = headerQuerySpy.mock
+        .calls[0]![0] as Statement;
+
+      expect(statement.query).toContain(
+        "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount) = 0",
+      );
+      expect(statement.query).not.toContain(
+        "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount) > 0",
+      );
+    });
   });
 
   describe("manifest", () => {

package/Tests/Types/API/HostnameAuthorityParsing.test.ts

@@ -142,6 +142,7 @@ describe("URL.fromString keeps the authority separate from the rest", () => {
 
     expect(url.email.toString()).toBe("support@oneuptime.com");
     expect(url.getQueryParam("subject")).toBe("Hello");
+    expect(url.toString()).toBe("mailto:support@oneuptime.com?subject=Hello");
   });
 
   test("a webhook URL with basic-auth credentials still round-trips", () => {

package/Tests/Types/API/URLMailtoQueryString.test.ts

@@ -0,0 +1,439 @@
+import Email from "../../../Types/Email";
+import Hostname from "../../../Types/API/Hostname";
+import Protocol from "../../../Types/API/Protocol";
+import Route from "../../../Types/API/Route";
+import URL from "../../../Types/API/URL";
+
+/*
+ * toString() never emitted the query string for a mailto: URL, so every
+ * prefilled field of a mail link was silently dropped:
+ * "mailto:a@b.com?subject=Hello&body=Hi" went back out as "mailto:a@b.com"
+ * and the link opened on an empty draft.
+ *
+ * The parse was never the problem — `params` held { subject, body } all along.
+ * The suffix was appended INSIDE the route-handling branch, and mailto skips
+ * that branch on purpose (it has no authority to trim and no path to append),
+ * so the query went with the route. mailto now returns early with the suffix
+ * attached, the way the opaque tel:/sms: branch above it already did.
+ */
+describe("mailto query string — the prefilled fields survive toString", () => {
+  test("a subject on its own reaches the output", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?subject=Hello");
+
+    expect(url.getQueryParam("subject")).toBe("Hello");
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello");
+  });
+
+  test("a subject and a body both reach the output", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?subject=Hello&body=Hi");
+
+    expect(url.params).toEqual({ subject: "Hello", body: "Hi" });
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello&body=Hi");
+  });
+
+  test("the parse was always right — only the output was lossy", () => {
+    /*
+     * Pins the exact shape of the bug rather than just its fix: params were
+     * correct before the change and are asserted separately from toString, so
+     * a regression that breaks only one of the two still shows which one.
+     */
+    const url: URL = URL.fromString("mailto:a@b.com?subject=Hello&body=Hi");
+
+    expect(url.params).toEqual({ subject: "Hello", body: "Hi" });
+    expect(url.toString()).not.toBe("mailto:a@b.com");
+    expect(url.toString()).toContain("subject=Hello");
+    expect(url.toString()).toContain("body=Hi");
+  });
+
+  test("cc and bcc survive alongside subject and body", () => {
+    const url: URL = URL.fromString(
+      "mailto:a@b.com?cc=c@d.com&bcc=e@f.com&subject=Hello&body=Hi",
+    );
+
+    expect(url.params).toEqual({
+      cc: "c@d.com",
+      bcc: "e@f.com",
+      subject: "Hello",
+      body: "Hi",
+    });
+    expect(url.toString()).toBe(
+      "mailto:a@b.com?cc=c@d.com&bcc=e@f.com&subject=Hello&body=Hi",
+    );
+  });
+
+  test("a mailto with no query gains no stray '?'", () => {
+    const url: URL = URL.fromString("mailto:support@oneuptime.com");
+
+    expect(url.toString()).toBe("mailto:support@oneuptime.com");
+    expect(url.toString()).not.toContain("?");
+  });
+});
+
+describe("mailto query string — a value that contains '='", () => {
+  test("an '=' inside a subject is not truncated", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?subject=a=b");
+
+    expect(url.getQueryParam("subject")).toBe("a=b");
+    expect(url.toString()).toBe("mailto:a@b.com?subject=a=b");
+  });
+
+  test("an '=' laden body keeps its whole expression", () => {
+    const url: URL = URL.fromString(
+      "mailto:ops@example.com?subject=Alert&body=filter: status = open AND team = ops",
+    );
+
+    expect(url.getQueryParam("body")).toBe(
+      "filter: status = open AND team = ops",
+    );
+    expect(url.toString()).toBe(
+      "mailto:ops@example.com?subject=Alert&body=filter: status = open AND team = ops",
+    );
+  });
+
+  test("only the first '=' separates, however many follow", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?body=x=y=z");
+
+    expect(url.params).toEqual({ body: "x=y=z" });
+    expect(url.toString()).toBe("mailto:a@b.com?body=x=y=z");
+  });
+
+  test("'==' padding does not swallow the params that follow it", () => {
+    const url: URL = URL.fromString(
+      "mailto:a@b.com?ref=YWJjZGVmZ2g==&subject=Hello",
+    );
+
+    expect(url.params).toEqual({ ref: "YWJjZGVmZ2g==", subject: "Hello" });
+    expect(url.toString()).toBe(
+      "mailto:a@b.com?ref=YWJjZGVmZ2g==&subject=Hello",
+    );
+  });
+});
+
+describe("mailto query string — round trip is lossless", () => {
+  const roundTripCases: Array<string> = [
+    "mailto:a@b.com",
+    "mailto:a@b.com?subject=Hello",
+    "mailto:a@b.com?subject=Hello&body=Hi",
+    "mailto:a@b.com?body=Hi&subject=Hello",
+    "mailto:a@b.com?cc=c@d.com&bcc=e@f.com&subject=Hello&body=Hi",
+    "mailto:a@b.com?subject=a=b",
+    "mailto:a@b.com?body=x=y=z",
+    "mailto:a@b.com?ref=YWJjZGVmZ2g==&subject=Hello",
+    "mailto:a@b.com?subject=Hello%20World&body=Line%0A2",
+    "mailto:a@b.com?subject=café ✓",
+    "mailto:a@b.com?body=see?tab=1",
+    "mailto:a@b.com?body=/a/b",
+    "mailto:a@b.com?flag",
+    "mailto:a+tag@b.com?subject=Hello",
+    "mailto:first.last@sub.example.co.uk?subject=Hello",
+    "mailto:support@oneuptime.com?subject=OneUptime%20Microsoft%20Teams%20Bot",
+    "mailto:security@oneuptime.com?subject=Security%20documentation%20request",
+  ];
+
+  test.each(roundTripCases)(
+    "URL.fromString(%s).toString() returns it unchanged",
+    (original: string) => {
+      expect(URL.fromString(original).toString()).toBe(original);
+    },
+  );
+
+  test.each(roundTripCases)(
+    "a second parse of %s is stable",
+    (original: string) => {
+      const once: string = URL.fromString(original).toString();
+
+      expect(URL.fromString(once).toString()).toBe(once);
+    },
+  );
+
+  test("fromURL round trips a mailto with a query", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?subject=Hello&body=Hi");
+
+    expect(URL.fromURL(url).toString()).toBe(
+      "mailto:a@b.com?subject=Hello&body=Hi",
+    );
+  });
+});
+
+describe("mailto query string — degenerate segments", () => {
+  test("a trailing '?' produces no params and no '?'", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?");
+
+    expect(url.params).toEqual({});
+    expect(url.toString()).toBe("mailto:a@b.com");
+  });
+
+  test("a value-less param is kept and re-emits bare", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?flag");
+
+    expect(url.params).toEqual({ flag: "" });
+    expect(url.toString()).toBe("mailto:a@b.com?flag");
+    expect(url.toString()).not.toContain("flag=");
+  });
+
+  test("an explicitly empty subject re-emits bare", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?subject=");
+
+    expect(url.params).toEqual({ subject: "" });
+    expect(url.toString()).toBe("mailto:a@b.com?subject");
+  });
+
+  test("a later duplicate key wins", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?subject=one&subject=two");
+
+    expect(url.getQueryParam("subject")).toBe("two");
+    expect(url.toString()).toBe("mailto:a@b.com?subject=two");
+  });
+
+  test("a '?' inside a body is not truncated", () => {
+    /*
+     * The address is taken from everything before the FIRST "?", and the query
+     * is everything after it — so a body that carries its own "?" survives.
+     */
+    const url: URL = URL.fromString("mailto:a@b.com?body=see?tab=1");
+
+    expect(url.getQueryParam("body")).toBe("see?tab=1");
+    expect(url.toString()).toBe("mailto:a@b.com?body=see?tab=1");
+  });
+
+  test("a '/' inside a body does not fabricate a route", () => {
+    /*
+     * Unlike a path-less https URL, whose authority is split off at the first
+     * "/" before the query is separated, a mailto never reaches that code:
+     * fromString takes its address from url.split("?")[0].
+     */
+    const url: URL = URL.fromString("mailto:a@b.com?body=/a/b");
+
+    expect(url.getQueryParam("body")).toBe("/a/b");
+    expect(url.route.toString()).toBe("");
+    expect(url.toString()).toBe("mailto:a@b.com?body=/a/b");
+  });
+
+  test("a unicode subject is passed through untouched", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?subject=café ✓");
+
+    expect(url.getQueryParam("subject")).toBe("café ✓");
+    expect(url.toString()).toBe("mailto:a@b.com?subject=café ✓");
+  });
+
+  test("a percent-encoded subject and body are passed through verbatim", () => {
+    const url: URL = URL.fromString(
+      "mailto:a@b.com?subject=Hello%20World&body=Line%0A2",
+    );
+
+    expect(url.params).toEqual({
+      subject: "Hello%20World",
+      body: "Line%0A2",
+    });
+    expect(url.toString()).toBe(
+      "mailto:a@b.com?subject=Hello%20World&body=Line%0A2",
+    );
+  });
+
+  test("a pair with no key is dropped", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?=novalue&subject=Hello");
+
+    expect(url.params).toEqual({ subject: "Hello" });
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello");
+  });
+});
+
+describe("mailto query string — the address is still an Email", () => {
+  test("the email is readable with a query present", () => {
+    const url: URL = URL.fromString("mailto:support@oneuptime.com?subject=Hi");
+
+    expect(url.email.toString()).toBe("support@oneuptime.com");
+    expect(url.protocol).toBe(Protocol.MAIL);
+    expect(url.toString()).toBe("mailto:support@oneuptime.com?subject=Hi");
+  });
+
+  test("a plus-addressed recipient keeps its tag", () => {
+    const url: URL = URL.fromString("mailto:a+tag@b.com?subject=Hello");
+
+    expect(url.email.toString()).toBe("a+tag@b.com");
+    expect(url.toString()).toBe("mailto:a+tag@b.com?subject=Hello");
+  });
+
+  test("an upper-case scheme is normalised and keeps its query", () => {
+    const url: URL = URL.fromString("MAILTO:a@b.com?subject=Hello");
+
+    expect(url.email.toString()).toBe("a@b.com");
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello");
+  });
+
+  test("a mailto payload that is not an email still keeps its query", () => {
+    /*
+     * "notanemail" fails Email.isValid, so the constructor stores it as a
+     * hostname and `email` is never set. The guard has to catch this case on
+     * the "mailto:" prefix rather than on `email`, or the query would be lost
+     * again for exactly these values.
+     */
+    const url: URL = URL.fromString("mailto:notanemail?subject=Hello");
+
+    expect(url.email).toBeUndefined();
+    expect(url.hostname.toString()).toBe("notanemail");
+    expect(url.toString()).toBe("mailto:notanemail?subject=Hello");
+  });
+});
+
+describe("mailto query string — constructed rather than parsed", () => {
+  test("the constructor takes a query alongside an Email", () => {
+    const url: URL = new URL(
+      Protocol.MAIL,
+      new Email("a@b.com"),
+      undefined,
+      "subject=Hello&body=Hi",
+    );
+
+    expect(url.params).toEqual({ subject: "Hello", body: "Hi" });
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello&body=Hi");
+  });
+
+  test("the constructor takes a query alongside a string address", () => {
+    const url: URL = new URL(
+      Protocol.MAIL,
+      "a@b.com",
+      undefined,
+      "subject=Hello",
+    );
+
+    expect(url.email.toString()).toBe("a@b.com");
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello");
+  });
+
+  test("addQueryParam prefills a mailto that had no query", () => {
+    const url: URL = URL.fromString("mailto:a@b.com").addQueryParam(
+      "subject",
+      "Hello",
+    );
+
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello");
+  });
+
+  test("addQueryParam with encode still round trips", () => {
+    const url: URL = URL.fromString("mailto:a@b.com").addQueryParam(
+      "subject",
+      "Hello World",
+      true,
+    );
+
+    expect(url.getQueryParam("subject")).toBe("Hello%20World");
+    expect(URL.fromString(url.toString()).getQueryParam("subject")).toBe(
+      "Hello%20World",
+    );
+  });
+
+  test("addQueryParams merges a body into an existing subject", () => {
+    const url: URL = URL.fromString(
+      "mailto:a@b.com?subject=Hello",
+    ).addQueryParams({ body: "Hi" });
+
+    expect(url.params).toEqual({ subject: "Hello", body: "Hi" });
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello&body=Hi");
+  });
+
+  test("removeQueryString strips the prefilled fields back off", () => {
+    const url: URL = URL.fromString(
+      "mailto:a@b.com?subject=Hello&body=Hi",
+    ).removeQueryString();
+
+    expect(url.params).toEqual({});
+    expect(url.toString()).toBe("mailto:a@b.com");
+  });
+});
+
+describe("mailto query string — crossing the wire", () => {
+  test("toJSON carries the query", () => {
+    const url: URL = URL.fromString("mailto:a@b.com?subject=Hello&body=Hi");
+
+    expect(url.toJSON()).toEqual({
+      _type: "URL",
+      value: "mailto:a@b.com?subject=Hello&body=Hi",
+    });
+  });
+
+  test("fromJSON restores a mailto with its query intact", () => {
+    const url: URL = URL.fromJSON(
+      URL.fromString("mailto:a@b.com?subject=Hello&body=Hi").toJSON(),
+    );
+
+    expect(url.getQueryParam("subject")).toBe("Hello");
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello&body=Hi");
+  });
+
+  test("a mailto with a query is not treated as malformed", () => {
+    const url: URL = URL.fromStringLenient("mailto:a@b.com?subject=Hello");
+
+    expect(url.isMalformed()).toBe(false);
+    expect(url.toString()).toBe("mailto:a@b.com?subject=Hello");
+  });
+});
+
+/*
+ * The fix returns early for mailto instead of widening the branch that builds
+ * the route, so the branch itself moved. These pin the shapes that go through
+ * it — every one of them held before the change and must still hold.
+ */
+describe("mailto query string — every other scheme is unaffected", () => {
+  const untouchedCases: Array<string> = [
+    "https://example.com/a/b?x=1",
+    "https://example.com/path",
+    "http://localhost:5000/api/test?a=1",
+    "wss://example.com/socket?a=1",
+    "mongodb://example.com/db?a=1",
+    "https://user:token@hooks.example.com/x",
+    "https://example.com/p?flag",
+    "https://example.com/p?a=b=c=d",
+    "tel:+15555550123?ref=a=b",
+    "sms:+15555550123?body=x=1&y=2",
+  ];
+
+  test.each(untouchedCases)("%s still round trips", (original: string) => {
+    expect(URL.fromString(original).toString()).toBe(original);
+  });
+
+  test("a path-less https URL still gains its trailing slash", () => {
+    expect(URL.fromString("https://example.com").toString()).toBe(
+      "https://example.com/",
+    );
+  });
+
+  test("a route given with a leading slash is not doubled", () => {
+    const url: URL = new URL(
+      Protocol.HTTPS,
+      new Hostname("example.com"),
+      new Route("/a/b"),
+      "x=1",
+    );
+
+    expect(url.toString()).toBe("https://example.com/a/b?x=1");
+  });
+
+  test("a route given without a leading slash still gets one", () => {
+    const url: URL = new URL(
+      Protocol.HTTPS,
+      new Hostname("example.com"),
+      new Route("a/b"),
+      "x=1",
+    );
+
+    expect(url.toString()).toBe("https://example.com/a/b?x=1");
+  });
+
+  test("an empty route still renders as a bare slash", () => {
+    const url: URL = new URL(
+      Protocol.HTTPS,
+      new Hostname("example.com"),
+      new Route(""),
+      "x=1",
+    );
+
+    expect(url.toString()).toBe("https://example.com/?x=1");
+  });
+
+  test("a malformed URL is still echoed back raw", () => {
+    expect(URL.fromStringLenient("https://tel:1234567890/").toString()).toBe(
+      "https://tel:1234567890/",
+    );
+  });
+});