@oneuptime/common 12.0.27 → 12.0.28

package/Models/AnalyticsModels/RumSessionChunk.ts

@@ -450,6 +450,56 @@ export default class RumSessionChunk extends AnalyticsBaseModel {
       });
     });
 
+    /*
+     * WHERE the page was while this chunk was open.
+     *
+     * The chunk table used to carry routeCount but not the routes, so the
+     * session header's entryUrl / exitUrl / routes[] could only ever be
+     * whatever chunk 0 happened to know - which for a single-page app is the
+     * landing page, forever. pageCount said "7 pages" on the same row where
+     * routes[] held one element, and the "Exit page URL (exact)" filter
+     * could not match a page the user demonstrably reached.
+     *
+     * Both are already scrubbed on the client AND re-scrubbed at ingest:
+     * these render under the wider session-metadata ACL, so an unscrubbed
+     * `/reset-password?token=...` here reaches more readers than the payload
+     * itself does.
+     */
+    const urlColumn: AnalyticsTableColumn = new AnalyticsTableColumn({
+      key: "url",
+      title: "URL",
+      description:
+        "Scrubbed URL the page was on when this chunk was flushed. The session's exit URL is the latest of these.",
+      /*
+       * Required with an empty default rather than nullable. Chunks written
+       * before this column existed read back as "", which is what the
+       * finalizer's argMinIf/argMaxIf skip over so a pre-migration session
+       * falls back to its provisional header instead of losing its URLs.
+       */
+      required: true,
+      defaultValue: "",
+      type: TableColumnType.Text,
+      codec: [{ codec: "ZSTD", level: 1 }],
+      accessControl: chunkAccessControl,
+    });
+
+    const routesColumn: AnalyticsTableColumn = new AnalyticsTableColumn({
+      key: "routes",
+      title: "Routes",
+      description:
+        "Distinct scrubbed URLs visited while this chunk was open, in order. The session's routes[] is the union of these.",
+      /*
+       * Required, like RumSession.routes. ClickHouse refuses
+       * Nullable(Array(String)) outright, so an array column can never be
+       * optional - it is empty or it is absent.
+       */
+      required: true,
+      defaultValue: [],
+      type: TableColumnType.ArrayText,
+      codec: [{ codec: "ZSTD", level: 1 }],
+      accessControl: chunkAccessControl,
+    });
+
     const retentionDateColumn: AnalyticsTableColumn = new AnalyticsTableColumn({
       key: "retentionDate",
       title: "Retention Date",
@@ -510,6 +560,8 @@ export default class RumSessionChunk extends AnalyticsBaseModel {
         payloadColumn,
         payloadBytesColumn,
         ...counterColumns,
+        urlColumn,
+        routesColumn,
         retentionDateColumn,
       ],
       sortKeys: ["projectId", "sessionId", "tabId", "chunkIndex"],

package/Models/DatabaseModels/CloudResource.ts

@@ -283,8 +283,22 @@ export default class CloudResource extends BaseModel {
   })
   public description?: string = undefined;
 
+  /*
+   * Creatable, never updatable - see the identical note on
+   * RumApplication.appIdentifier. `create: []` on a required column that the
+   * Cloud Resources create form declares made manual creation impossible:
+   * the field was stripped from the form and the server then rejected the
+   * POST for the very value it had just removed.
+   */
   @ColumnAccessControl({
-    create: [],
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateCloudResource,
+    ],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -305,6 +319,8 @@ export default class CloudResource extends BaseModel {
     description:
       "Stable identifier for this managed-compute workload (service.name, falling back to host.name). Identity key for this resource.",
   })
+  /* Case-insensitive uniqueness; see RumApplication.appIdentifier. */
+  @UniqueColumnBy("projectId")
   @Column({
     nullable: false,
     type: ColumnType.ShortText,

package/Models/DatabaseModels/RumApplication.ts

@@ -286,8 +286,31 @@ export default class RumApplication extends BaseModel {
   })
   public description?: string = undefined;
 
+  /*
+   * Creatable, never updatable.
+   *
+   * `create: []` here made the documented "create an application by hand"
+   * flow (docs/rum/applications.md) impossible: ModelForm drops any field
+   * the caller has no create permission on, so the Dashboard's required
+   * "App Identifier" input never rendered, and the POST that followed was
+   * rejected by the server with a raw `appIdentifier is required`. The
+   * column is required and has no default, so nothing could supply it.
+   *
+   * `update` stays empty on purpose. This value is the application's
+   * identity - telemetry is filed under it and the (projectId,
+   * appIdentifier) index is unique - so re-pointing it after the fact would
+   * orphan every session, trace and recording already keyed on the old one.
+   * Same shape as ServerlessFunction.functionIdentifier.
+   */
   @ColumnAccessControl({
-    create: [],
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateRumApplication,
+    ],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -308,6 +331,16 @@ export default class RumApplication extends BaseModel {
     description:
       "Stable identifier for this application from the service.name OpenTelemetry resource attribute. Identity key for this RUM application.",
   })
+  /*
+   * Case-INSENSITIVE uniqueness, which the unique index on
+   * (projectId, appIdentifier) does not give: Postgres compares it byte for
+   * byte, while RumApplicationService.findOrCreateByAppIdentifier resolves
+   * an incoming service.name with QueryHelper.findWithSameText, which
+   * lowercases. Without this, someone hand-creating "Storefront-Web" beside
+   * an auto-discovered "storefront-web" passes the index and leaves two rows
+   * that the case-insensitive lookup resolves arbitrarily.
+   */
+  @UniqueColumnBy("projectId")
   @Column({
     nullable: false,
     type: ColumnType.ShortText,
@@ -1245,7 +1278,7 @@ export default class RumApplication extends BaseModel {
     type: TableColumnType.Boolean,
     title: "Capture Session Replay User Identity",
     description:
-      "When enabled, the raw end-user reference supplied by the host page is stored alongside the recording, so a support engineer can find the session a named customer is complaining about. When off, only a one-way per-project HMAC of it is stored. On by default. Narrower create/update ACL than the other replay settings: this is the switch that turns a pseudonymous recording into an identified one.",
+      "When enabled, the end-user reference supplied by the host page is stored alongside the recording - as a one-way per-project HMAC for lookup and erasure, plus the raw reference behind its own narrower column ACL - so a support engineer can find the session a named customer is complaining about. When off, the reference is never attached to a recording and neither column is stored. (It is still sent once on the policy request, which is how targeted capture matches a named user; it is not persisted.) The reference must be supplied at load time - identify() called later reaches the server only on the session's final chunk, which the header is not rebuilt from. On by default. Narrower create/update ACL than the other replay settings: this is the switch that turns a pseudonymous recording into an identified one.",
     defaultValue: true,
   })
   @Column({

package/Server/API/TelemetryAPI.ts

@@ -115,6 +115,7 @@ import RumApplication from "../../Models/DatabaseModels/RumApplication";
 import RumApplicationService from "../Services/RumApplicationService";
 import Project from "../../Models/DatabaseModels/Project";
 import ProjectService from "../Services/ProjectService";
+import SessionReplayIdentity from "../Utils/SessionReplay/SessionReplayIdentity";
 import SessionReplayTargeting from "../Utils/SessionReplay/SessionReplayTargeting";
 import SessionReplayUsage from "../Utils/SessionReplay/SessionReplayUsage";
 import RumSessionReplayView from "../../Models/DatabaseModels/RumSessionReplayView";
@@ -134,6 +135,7 @@ import {
   DEFAULT_SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY,
   MAX_SESSION_REPLAY_CHUNKS_PER_READ,
   MAX_SESSION_REPLAY_READ_BYTES,
+  SESSION_REPLAY_MAX_USER_REF_LENGTH,
 } from "../../Types/Rum/SessionReplay";
 
 const router: ExpressRouter = Express.getRouter();
@@ -3495,6 +3497,14 @@ router.post(
 /*
  * Listing sessions. Mirrors RumSession's table-level read ACL exactly:
  * knowing WHICH sessions errored is triage.
+ *
+ * Including the PAYLOAD permission, which that ACL also carries and this
+ * guard used to omit. Watching implies listing: the payload routes authorize
+ * on ReadRumSessionReplayPayload alone, so a role granted only "Watch
+ * Session Replays" could play back any session whose id it was handed while
+ * being 401'd on the list, the manifest and the exception page's replay card
+ * - an incoherent grant rather than a safer one, and exactly what
+ * RumSession's own comment says the ACL exists to prevent.
  */
 const requireSessionReplayListAccess: Array<RequestHandler> = [
   UserMiddleware.getUserMiddleware,
@@ -3505,6 +3515,7 @@ const requireSessionReplayListAccess: Array<RequestHandler> = [
       Permission.ProjectAdmin,
       Permission.TelemetryAdmin,
       Permission.ReadRumSessionReplay,
+      Permission.ReadRumSessionReplayPayload,
     ],
   }),
 ];
@@ -3534,6 +3545,20 @@ const SESSION_REPLAY_LIST_PERMISSIONS: Array<Permission> = [
   Permission.ProjectAdmin,
   Permission.TelemetryAdmin,
   Permission.ReadRumSessionReplay,
+  /*
+   * Watching implies listing.
+   *
+   * RumSession's own table read ACL contains this permission for a reason it
+   * states outright: a role granted only the watch permission could fetch
+   * payloads (the payload routes authorize on it alone) while being 401'd on
+   * the manifest and the list - an incoherent grant rather than a safer one.
+   * Leaving it out here meant a support-engineer role built from "Watch
+   * Session Replays" + "Read RUM Application" - the natural pairing, and the
+   * one the permission's own description suggests - got a permission error
+   * on the session list and a silently missing "Watch what the user saw"
+   * card on every exception page.
+   */
+  Permission.ReadRumSessionReplayPayload,
 ];
 
 const SESSION_REPLAY_PAYLOAD_PERMISSIONS: Array<Permission> = [
@@ -4131,8 +4156,51 @@ router.post(
         ? OneUptimeDate.fromString(body["endTime"] as string)
         : OneUptimeDate.getCurrentDate();
 
+      /*
+       * The narrower identity ACL, resolved BEFORE the filters are built.
+       *
+       * It is enforced by simply not naming the column in the SELECT - there
+       * is no ModelPermission on this path to strip it after the fact - and
+       * it is decided against the application already loaded by the access
+       * check, so a caller whose identity grant is label-scoped elsewhere
+       * does not get named end users here.
+       *
+       * It gates the identity FILTER as well as the column. Without that,
+       * a caller deliberately denied the label could still ask "does
+       * jane@example.com have sessions here" and read every other field of
+       * the answer - a dictionary attack that de-anonymises the list one
+       * candidate at a time, and hands back identifiedUserKey as a stable
+       * pseudonym to join against the route filter. The permission sets are
+       * genuinely different: SESSION_REPLAY_IDENTITY_PERMISSIONS excludes
+       * TelemetryAdmin and ReadRumSessionReplay, both of which can list.
+       */
+      const includeIdentifiedUserLabel: boolean = canReadIdentifiedUserLabel({
+        databaseProps: databaseProps,
+        application: application,
+      });
+
       const rawFilters: JSONObject = (body["filters"] as JSONObject) || {};
 
+      /*
+       * A reference the server cannot hash must be a 400, never a filter
+       * that quietly disappears. Dropping it would return the WHOLE
+       * unfiltered list with a 200 - the caller sees every session in the
+       * project and has no way to tell that the person they asked about was
+       * not the one being answered about.
+       */
+      if (
+        rawFilters["identifiedUserRef"] !== undefined &&
+        !SessionReplayIdentity.isUsableUserRef(rawFilters["identifiedUserRef"])
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            `identifiedUserRef must be a non-empty string of at most ${SESSION_REPLAY_MAX_USER_REF_LENGTH} characters.`,
+          ),
+        );
+      }
+
       const filters: SessionReplayListFilters = {
         ...(typeof rawFilters["hasError"] === "boolean" && {
           hasError: rawFilters["hasError"],
@@ -4158,9 +4226,42 @@ router.post(
         ...(readStringArrayFromBody(rawFilters, "countryCodes") && {
           countryCodes: readStringArrayFromBody(rawFilters, "countryCodes"),
         }),
-        ...(typeof rawFilters["identifiedUserKey"] === "string" && {
-          identifiedUserKey: rawFilters["identifiedUserKey"],
-        }),
+        /*
+         * The caller sends the end-user reference their own page supplied -
+         * the value the session list displays - and the server derives the
+         * digest with the same per-project HMAC the ingest used. Hashing
+         * here rather than in the browser is what keeps the derivation (and
+         * the EncryptionSecret it is keyed on) server-side, and it is the
+         * only reason this filter can match anything: the raw key is
+         * displayed nowhere in the product, so a user had no way to obtain
+         * the value the field used to demand.
+         *
+         * Gated on the identity permission, and validated above so an
+         * unusable reference is a 400 rather than a silently unfiltered
+         * list.
+         */
+        ...(includeIdentifiedUserLabel &&
+          SessionReplayIdentity.isUsableUserRef(
+            rawFilters["identifiedUserRef"],
+          ) && {
+            identifiedUserKey: SessionReplayIdentity.buildUserKey({
+              projectId: projectId,
+              userRef: rawFilters["identifiedUserRef"] as string,
+            }),
+          }),
+        /*
+         * Still accepted, for API callers that already hold a digest (an
+         * erasure workflow, a saved view). Ignored when a reference was also
+         * sent, since the reference is the one a human typed. The digest is
+         * not guessable and is already returned to every list-capable
+         * caller, so it needs no identity gate of its own.
+         */
+        ...(typeof rawFilters["identifiedUserKey"] === "string" &&
+          !SessionReplayIdentity.isUsableUserRef(
+            rawFilters["identifiedUserRef"],
+          ) && {
+            identifiedUserKey: rawFilters["identifiedUserKey"],
+          }),
         ...(typeof rawFilters["route"] === "string" && {
           route: rawFilters["route"],
         }),
@@ -4183,18 +4284,6 @@ router.post(
             }
           : undefined;
 
-      /*
-       * The narrower identity ACL is enforced by simply not naming the
-       * column in the SELECT. There is no ModelPermission on this path to
-       * strip it after the fact. Decided against the application already
-       * loaded by the access check, so a caller whose identity grant is
-       * label-scoped elsewhere does not get named end users here.
-       */
-      const includeIdentifiedUserLabel: boolean = canReadIdentifiedUserLabel({
-        databaseProps: databaseProps,
-        application: application,
-      });
-
       const result: SessionReplayListResult =
         await SessionReplayReadService.listSessions({
           projectId: projectId,

package/Server/Utils/SessionReplay/SessionReplayGateCache.ts

@@ -105,11 +105,18 @@ export interface SessionReplayGatePolicy {
   isAppEnabled: boolean;
 
   /*
-   * Empty means REFUSED, not allow-all. This is the only anti-forgery
-   * control available: a TelemetryIngestionKey has no expiry, no scope and
-   * no origin binding, and the docs tell customers to paste it into
-   * browser JavaScript, so anyone who scrapes the key could otherwise
-   * write recordings into the victim's project.
+   * Empty means ANY ORIGIN, which is the shipped default (the column
+   * defaults to '[]') and what isOriginAllowed below actually implements -
+   * this doc used to claim the opposite ("empty means REFUSED"), in the one
+   * direction where being wrong matters, since a reader would conclude the
+   * feature was locked down out of the box.
+   *
+   * Filling it in is the only anti-forgery control available: a
+   * TelemetryIngestionKey has no expiry, no scope and no origin binding, and
+   * the docs tell customers to paste it into browser JavaScript, so anyone
+   * who scrapes the key can write recordings into the victim's project until
+   * this list names the customer's own domains. The installation-test panel
+   * flags an empty list as a warning for exactly that reason.
    */
   allowedOrigins: Array<string>;
 

package/Server/Utils/SessionReplay/SessionReplayIdentity.ts

@@ -0,0 +1,102 @@
+import crypto from "crypto";
+import { EncryptionSecret } from "../../EnvironmentConfig";
+import ObjectID from "../../../Types/ObjectID";
+import { SESSION_REPLAY_MAX_USER_REF_LENGTH } from "../../../Types/Rum/SessionReplay";
+
+/*
+ * "Whose session is this?"
+ *
+ * A page that has an end-user reference hands it to the recorder
+ * (data-oneuptime-user-ref, or the init global). When the application has
+ * identity capture switched on, the recorder puts that reference on the
+ * chunk envelope's meta, and this module turns it into the two columns the
+ * session header carries:
+ *
+ *   identifiedUserKey    HMAC(EncryptionSecret, "<projectId>:<userRef>")
+ *   identifiedUserLabel  the reference itself, behind its own column ACL
+ *
+ * The key is what makes a reference SEARCHABLE and ERASABLE without storing
+ * it in a lookup-friendly form: a support engineer filtering by user, and a
+ * right-to-erasure request naming one, both resolve to the same digest. The
+ * label is what makes a session READABLE - "jane@example.com" rather than a
+ * 64-character hash - and is why it sits behind a narrower ACL than the rest
+ * of the session metadata.
+ *
+ * Scoped by project and NOT by application, deliberately. A project-wide
+ * erasure request (ProcessSessionErasureRequests filters on projectId with
+ * the application clause optional) has to be able to reach every session for
+ * that person, including ones recorded by sibling applications. An
+ * application-scoped digest would make that request silently under-delete,
+ * which is the failure mode with legal consequences.
+ *
+ * Deliberately NOT reusing SessionReplayTargeting.buildTargetKey: that one
+ * is application-scoped and prefixed for a Redis keyspace. Both are HMACs of
+ * a user reference, and conflating them would tie an erasure lookup to the
+ * shape of a Redis key.
+ */
+
+export interface SessionReplayUserKeyInput {
+  projectId: ObjectID;
+  userRef: string;
+}
+
+export default class SessionReplayIdentity {
+  /*
+   * Usable when non-empty and within the shared cap. The cap matters on both
+   * sides of the comparison: the recorder slices the reference to the same
+   * length before sending it, so anything longer could never match a stored
+   * key anyway, and hashing an unbounded string here would be the only
+   * unbounded work on this path.
+   */
+  public static isUsableUserRef(userRef: unknown): userRef is string {
+    return (
+      typeof userRef === "string" &&
+      userRef.trim().length > 0 &&
+      userRef.length <= SESSION_REPLAY_MAX_USER_REF_LENGTH
+    );
+  }
+
+  /*
+   * The project scope lives in the KEY, not in the message.
+   *
+   * HMAC takes arbitrary key material, so deriving a per-project key from
+   * the instance secret and the project id gives real domain separation:
+   * two projects cannot produce the same digest for the same person even
+   * if one of them learns the other's project id, which prefixing the
+   * message only achieves by convention. It is also what makes the
+   * "per-project" wording on the identity columns literally true.
+   *
+   * The reference is trimmed but NOT lower-cased. End-user references are
+   * opaque to us - "U-1000" and "u-1000" may well be two different
+   * customers in the host application's own database - so folding case here
+   * would merge two people's recordings under one key, and an erasure for
+   * one would delete the other's. Targeting lower-cases the APPLICATION
+   * identifier for the same reason in reverse: that one is ours and is
+   * case-insensitive.
+   *
+   * A slow KDF (bcrypt / scrypt / argon2) is deliberately NOT used and
+   * would not help. This is a keyed pseudonym, not a stored password: it
+   * has to be DETERMINISTIC so the session filter and a right-to-erasure
+   * request months later resolve the same digest, and those algorithms are
+   * salted per invocation. What defends the digest is the key - without
+   * EncryptionSecret an attacker holding the column cannot test candidate
+   * references at all, at any work factor.
+   */
+  public static buildUserKey(data: SessionReplayUserKeyInput): string {
+    const projectKey: string = `${EncryptionSecret.toString()}:${data.projectId.toString()}`;
+
+    return crypto
+      .createHmac("sha256", projectKey)
+      .update(data.userRef.trim())
+      .digest("hex");
+  }
+
+  /*
+   * The label as stored. Trimmed and capped to the same length the recorder
+   * enforces, so the column can never hold something the wire could not have
+   * carried.
+   */
+  public static buildUserLabel(userRef: string): string {
+    return userRef.trim().slice(0, SESSION_REPLAY_MAX_USER_REF_LENGTH);
+  }
+}

package/Server/Utils/SessionReplay/SessionReplayReadService.ts

@@ -1341,13 +1341,22 @@ export default class SessionReplayReadService {
       );
     }
 
-    if (filters.hasFrustration === true) {
+    if (filters.hasFrustration !== undefined) {
       /*
        * Over the argMax aliases, like every HAVING predicate here — the
        * raw columns would sum across ReplacingMergeTree versions.
+       *
+       * `!== undefined` rather than `=== true`, so `false` means "sessions
+       * with NO frustration signals" instead of being silently dropped. The
+       * route admits any boolean, and hasError / isFinalized beside it both
+       * honour false, so accepting the value and ignoring it returned the
+       * whole unfiltered list with a 200 and no indication why.
        */
+      const total: string =
+        "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount)";
+
       statement.append(
-        " AND (aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount) > 0",
+        filters.hasFrustration ? ` AND ${total} > 0` : ` AND ${total} = 0`,
       );
     }
 

package/Tests/Models/DatabaseModels/SessionReplayModels.test.ts

@@ -5,6 +5,7 @@ import AuditLog from "../../../Models/AnalyticsModels/AuditLog";
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import { PlanType } from "../../../Types/Billing/SubscriptionPlan";
 import Project from "../../../Models/DatabaseModels/Project";
+import CloudResource from "../../../Models/DatabaseModels/CloudResource";
 import RumApplication from "../../../Models/DatabaseModels/RumApplication";
 import RumSessionErasureRequest from "../../../Models/DatabaseModels/RumSessionErasureRequest";
 import RumSessionPin from "../../../Models/DatabaseModels/RumSessionPin";
@@ -61,6 +62,86 @@ describe("RumApplication session replay configuration", () => {
     return model.getTableColumnMetadata(columnName);
   };
 
+  /*
+   * The identity column has to be CREATABLE and NEVER UPDATABLE.
+   *
+   * It shipped as `create: []` on a required column with no default, which
+   * made the documented "create an application by hand" flow impossible:
+   * ModelForm drops any field the caller has no create permission on, so the
+   * Dashboard's required "App Identifier" input never rendered, and the POST
+   * that followed was rejected by the server with "appIdentifier is
+   * required". The Create button was a dead end for every user.
+   */
+  it("lets a user supply the app identifier at creation time", () => {
+    const accessControl: ColumnAccessControl | null =
+      model.getColumnAccessControlFor("appIdentifier");
+
+    expect(accessControl).toBeDefined();
+    expect(accessControl!.create.length).toBeGreaterThan(0);
+    expect(accessControl!.create).toContain(Permission.ProjectOwner);
+    expect(accessControl!.create).toContain(Permission.CreateRumApplication);
+  });
+
+  it("never lets the app identifier be edited afterwards", () => {
+    /*
+     * Deliberately immutable. Telemetry, sessions, traces and recordings are
+     * all filed under this value and the (projectId, appIdentifier) index is
+     * unique, so re-pointing it after the fact would orphan every row that
+     * already references it. If this list is ever populated, the orphaning
+     * has to be solved first - do not "tidy it up" to match `create`.
+     */
+    const accessControl: ColumnAccessControl | null =
+      model.getColumnAccessControlFor("appIdentifier");
+
+    expect(accessControl!.update).toEqual([]);
+  });
+
+  /*
+   * The create form declares an "App Identifier" field. That field can only
+   * render if the column is creatable, and the POST can only succeed if the
+   * required column is supplied - so a required column with an empty create
+   * list is always a dead form, whatever the page source says.
+   *
+   * CloudResource.resourceIdentifier is checked alongside because it had the
+   * identical defect on the identical page shape: an auto-discovered
+   * identity column whose dashboard page also offers a Create button.
+   */
+  it.each([
+    ["RumApplication", new RumApplication() as BaseModel],
+    ["CloudResource", new CloudResource() as BaseModel],
+  ])(
+    "%s has no required column that the user is forbidden to create",
+    (_name: string, subject: BaseModel) => {
+      const uncreatable: Array<string> = [];
+
+      for (const columnName of subject.getTableColumns().columns) {
+        const metadata: TableColumnMetadata =
+          subject.getTableColumnMetadata(columnName);
+        const accessControl: ColumnAccessControl | null =
+          subject.getColumnAccessControlFor(columnName);
+
+        if (!metadata.required || metadata.defaultValue !== undefined) {
+          continue;
+        }
+
+        /* System columns nobody submits through a form. */
+        if (
+          ["_id", "createdAt", "updatedAt", "version", "slug"].includes(
+            columnName,
+          )
+        ) {
+          continue;
+        }
+
+        if (accessControl && accessControl.create.length === 0) {
+          uncreatable.push(columnName);
+        }
+      }
+
+      expect(uncreatable).toEqual([]);
+    },
+  );
+
   it("declares every session replay configuration column", () => {
     const expectedColumns: Array<string> = [
       "isSessionReplayEnabled",