@oneuptime/common 12.0.27 → 12.0.29

package/Tests/Server/API/MicrosoftTeamsBotTestEndpoint.test.ts

@@ -238,6 +238,18 @@ describe("GET /microsoft-bot/test", () => {
         "the installed Teams app package belonging to this deployment",
         ["installed", "this deployment"],
       ],
+      /*
+       * Reachability is listed apart from the endpoint being *configured*
+       * because the two fail separately and are indistinguishable from in
+       * here. A correctly configured endpoint on a deployment Azure cannot
+       * dial produces working outbound alerts and a completely dead bot —
+       * which reads as a half-broken integration rather than a network
+       * problem, and is how this endpoint's blessing gets misread.
+       */
+      [
+        "Azure Bot Service being able to reach this deployment",
+        ["reach this deployment", "public internet"],
+      ],
     ])(
       "notVerified explicitly disclaims %s",
       async (_label: string, requiredFragments: Array<string>) => {
@@ -257,6 +269,20 @@ describe("GET /microsoft-bot/test", () => {
       },
     );
 
+    test("notVerified warns that a working alert does not test reachability", async () => {
+      /*
+       * The trap this endpoint exists to avoid: an admin whose alerts arrive
+       * in Teams reads that as proof the bot is wired up, when outbound
+       * notifications go out over a connection OneUptime opens itself and
+       * never touch the inbound path the bot depends on.
+       */
+      const response: InvokedResponse = await callBotTest();
+      const joined: string = joinStrings(response.body["notVerified"]);
+
+      expect(joined).toContain("outbound notifications work without it");
+      expect(joined).toContain("working alert does not test this");
+    });
+
     test("nextStep names the client id and tells the admin to compare it against the installed app's bot id", async () => {
       const response: InvokedResponse = await callBotTest();
       const nextStep: string = response.body["nextStep"] as string;

package/Tests/Server/API/MicrosoftTeamsLegacyWebhookRemoval.test.ts

@@ -0,0 +1,402 @@
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+import type { TurnContext } from "botbuilder";
+import type { SpyInstance } from "jest-mock";
+import MicrosoftTeamsAPI from "../../../Server/API/MicrosoftTeamsAPI";
+import WorkspaceProjectAuthToken from "../../../Models/DatabaseModels/WorkspaceProjectAuthToken";
+import AccessTokenService from "../../../Server/Services/AccessTokenService";
+import AlertService from "../../../Server/Services/AlertService";
+import IncidentService from "../../../Server/Services/IncidentService";
+import TeamMemberService from "../../../Server/Services/TeamMemberService";
+import WorkspaceProjectAuthTokenService from "../../../Server/Services/WorkspaceProjectAuthTokenService";
+import WorkspaceUserAuthTokenService from "../../../Server/Services/WorkspaceUserAuthTokenService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  ExpressRouter,
+} from "../../../Server/Utils/Express";
+import {
+  MicrosoftTeamsAlertActionType,
+  MicrosoftTeamsIncidentActionType,
+  MicrosoftTeamsMonitorActionType,
+} from "../../../Server/Utils/Workspace/MicrosoftTeams/Actions/ActionTypes";
+import MicrosoftTeamsAuthAction from "../../../Server/Utils/Workspace/MicrosoftTeams/Actions/Auth";
+import MicrosoftTeamsIncidentActions from "../../../Server/Utils/Workspace/MicrosoftTeams/Actions/Incident";
+import MicrosoftTeamsMonitorActions from "../../../Server/Utils/Workspace/MicrosoftTeams/Actions/Monitor";
+import MicrosoftTeamsUtil from "../../../Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+
+jest.setTimeout(30_000);
+
+type ExpressRouterLayer = {
+  route?: {
+    path: string;
+    methods: Record<string, boolean>;
+    stack: Array<{
+      handle: ExpressRouteHandler;
+    }>;
+  };
+};
+
+type ExpressRouteHandler = (
+  request: ExpressRequest,
+  response: ExpressResponse,
+) => Promise<void> | void;
+
+const LEGACY_WEBHOOK_PATH: string = "/microsoft-teams/webhook";
+const BOT_FRAMEWORK_PATH: string = "/microsoft-bot/messages";
+
+const getRouterLayers: () => Array<ExpressRouterLayer> =
+  (): Array<ExpressRouterLayer> => {
+    const router: ExpressRouter = new MicrosoftTeamsAPI().getRouter();
+    return (
+      router as unknown as {
+        stack: Array<ExpressRouterLayer>;
+      }
+    ).stack;
+  };
+
+const dispatchThroughRouter: (
+  path: string,
+  body: JSONObject,
+) => Promise<void> = (path: string, body: JSONObject): Promise<void> => {
+  return new Promise<void>(
+    (resolve: () => void, reject: (error: Error) => void): void => {
+      const router: ExpressRouter = new MicrosoftTeamsAPI().getRouter();
+      const request: ExpressRequest = {
+        method: "POST",
+        url: path,
+        originalUrl: path,
+        baseUrl: "",
+        headers: {},
+        body: body,
+      } as unknown as ExpressRequest;
+      const response: ExpressResponse = {} as ExpressResponse;
+
+      router(request, response, (error?: unknown): void => {
+        if (error) {
+          reject(error as Error);
+          return;
+        }
+
+        resolve();
+      });
+    },
+  );
+};
+
+const getPostRouteHandler: (path: string) => ExpressRouteHandler = (
+  path: string,
+): ExpressRouteHandler => {
+  const layer: ExpressRouterLayer | undefined = getRouterLayers().find(
+    (routerLayer: ExpressRouterLayer): boolean => {
+      return (
+        routerLayer.route?.path === path &&
+        routerLayer.route.methods["post"] === true
+      );
+    },
+  );
+
+  if (!layer?.route?.stack[0]) {
+    throw new Error(`POST route handler not found for ${path}`);
+  }
+
+  return layer.route.stack[0].handle;
+};
+
+const forgedInvokeBody: (action: string) => JSONObject = (
+  action: string,
+): JSONObject => {
+  return {
+    type: "invoke",
+    from: {
+      id: "attacker-controlled-linked-teams-user-id",
+    },
+    conversation: {
+      id: "attacker-controlled-conversation-id",
+    },
+    channelData: {
+      team: {
+        id: "any-non-empty-team-id",
+      },
+      tenant: {
+        id: "target-connected-tenant-id",
+      },
+    },
+    value: {
+      action: action,
+      actionValue: "11111111-2222-4333-8444-555555555555",
+    },
+  };
+};
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("Microsoft Teams inbound route authentication", () => {
+  test("does not register the unauthenticated legacy webhook for any method", () => {
+    const legacyLayers: Array<ExpressRouterLayer> = getRouterLayers().filter(
+      (layer: ExpressRouterLayer): boolean => {
+        return layer.route?.path === LEGACY_WEBHOOK_PATH;
+      },
+    );
+
+    expect(legacyLayers).toEqual([]);
+  });
+
+  test("keeps exactly one POST route for the authenticated Bot Framework adapter", () => {
+    /*
+     * Counted by method rather than by layer. What must stay unique is the
+     * inbound POST — a second one is how the unauthenticated legacy webhook
+     * got in, and this test exists to keep it out. The path itself carries a
+     * second layer on purpose since the 405 diagnostic landed: a GET handler
+     * that answers a browser probe instead of letting it fall through to the
+     * catch-all 404, which is what convinced the reporter of #3488 that the
+     * route had been dropped from the build.
+     *
+     * So: exactly one layer accepts POST, and no other layer on this path
+     * accepts POST either. The second assertion is the one doing the security
+     * work — a layer registered with router.all() would accept POST while
+     * reporting no `post` key of its own.
+     */
+    const botFrameworkLayers: Array<ExpressRouterLayer> =
+      getRouterLayers().filter((layer: ExpressRouterLayer): boolean => {
+        return layer.route?.path === BOT_FRAMEWORK_PATH;
+      });
+
+    const postLayers: Array<ExpressRouterLayer> = botFrameworkLayers.filter(
+      (layer: ExpressRouterLayer): boolean => {
+        return layer.route?.methods["post"] === true;
+      },
+    );
+
+    expect(postLayers).toHaveLength(1);
+    expect(postLayers[0]!.route!.methods).toEqual({ post: true });
+
+    const otherLayerMethods: Array<string> = botFrameworkLayers
+      .filter((layer: ExpressRouterLayer): boolean => {
+        return layer !== postLayers[0];
+      })
+      .flatMap((layer: ExpressRouterLayer): Array<string> => {
+        return Object.keys(layer.route!.methods);
+      });
+
+    expect(otherLayerMethods).not.toContain("post");
+    expect(otherLayerMethods).not.toContain("_all");
+  });
+
+  test.each([
+    MicrosoftTeamsIncidentActionType.AckIncident,
+    MicrosoftTeamsIncidentActionType.ResolveIncident,
+    MicrosoftTeamsAlertActionType.AckAlert,
+    MicrosoftTeamsAlertActionType.ResolveAlert,
+  ])(
+    "falls through without lookup or mutation for unsigned forged %s",
+    async (action: string) => {
+      const projectLookupSpy: SpyInstance<
+        typeof WorkspaceProjectAuthTokenService.findOneBy
+      > = jest
+        .spyOn(WorkspaceProjectAuthTokenService, "findOneBy")
+        .mockResolvedValue(null);
+      const userLookupSpy: SpyInstance<
+        typeof WorkspaceUserAuthTokenService.findOneBy
+      > = jest
+        .spyOn(WorkspaceUserAuthTokenService, "findOneBy")
+        .mockResolvedValue(null);
+      const acknowledgeIncidentSpy: SpyInstance<
+        typeof IncidentService.acknowledgeIncident
+      > = jest
+        .spyOn(IncidentService, "acknowledgeIncident")
+        .mockRejectedValue(new Error("unexpected incident mutation"));
+      const resolveIncidentSpy: SpyInstance<
+        typeof IncidentService.resolveIncident
+      > = jest
+        .spyOn(IncidentService, "resolveIncident")
+        .mockRejectedValue(new Error("unexpected incident mutation"));
+      const acknowledgeAlertSpy: SpyInstance<
+        typeof AlertService.acknowledgeAlert
+      > = jest
+        .spyOn(AlertService, "acknowledgeAlert")
+        .mockRejectedValue(new Error("unexpected alert mutation"));
+      const resolveAlertSpy: SpyInstance<typeof AlertService.resolveAlert> =
+        jest
+          .spyOn(AlertService, "resolveAlert")
+          .mockRejectedValue(new Error("unexpected alert mutation"));
+      const botFrameworkSpy: SpyInstance<
+        typeof MicrosoftTeamsUtil.processBotActivity
+      > = jest.spyOn(MicrosoftTeamsUtil, "processBotActivity");
+
+      await dispatchThroughRouter(
+        LEGACY_WEBHOOK_PATH,
+        forgedInvokeBody(action),
+      );
+
+      expect(projectLookupSpy).not.toHaveBeenCalled();
+      expect(userLookupSpy).not.toHaveBeenCalled();
+      expect(acknowledgeIncidentSpy).not.toHaveBeenCalled();
+      expect(resolveIncidentSpy).not.toHaveBeenCalled();
+      expect(acknowledgeAlertSpy).not.toHaveBeenCalled();
+      expect(resolveAlertSpy).not.toHaveBeenCalled();
+      expect(botFrameworkSpy).not.toHaveBeenCalled();
+    },
+  );
+
+  test("delegates the supported endpoint to the Bot Framework adapter", async () => {
+    const botFrameworkSpy: SpyInstance<
+      typeof MicrosoftTeamsUtil.processBotActivity
+    > = jest
+      .spyOn(MicrosoftTeamsUtil, "processBotActivity")
+      .mockResolvedValue();
+    const request: ExpressRequest = {
+      body: forgedInvokeBody(MicrosoftTeamsIncidentActionType.ResolveIncident),
+    } as unknown as ExpressRequest;
+    const response: ExpressResponse = {} as ExpressResponse;
+    const handler: ExpressRouteHandler =
+      getPostRouteHandler(BOT_FRAMEWORK_PATH);
+
+    await handler(request, response);
+
+    expect(botFrameworkSpy).toHaveBeenCalledTimes(1);
+    expect(botFrameworkSpy).toHaveBeenCalledWith(request, response);
+  });
+
+  test("adds the linked user's accepted team IDs to the Bot invoke permission context", async () => {
+    const projectId: ObjectID = ObjectID.generate();
+    const userId: ObjectID = ObjectID.generate();
+    const teamIds: Array<ObjectID> = [ObjectID.generate(), ObjectID.generate()];
+    const projectAuth: WorkspaceProjectAuthToken =
+      new WorkspaceProjectAuthToken();
+    projectAuth.projectId = projectId;
+
+    const databaseProps: DatabaseCommonInteractionProps = {
+      userId: userId,
+      tenantId: projectId,
+    };
+
+    jest
+      .spyOn(MicrosoftTeamsUtil, "resolveProjectByTenantId")
+      .mockResolvedValue({
+        projectAuth: projectAuth,
+        isAmbiguous: false,
+        candidateProjectIds: [projectId],
+      });
+    jest
+      .spyOn(MicrosoftTeamsAuthAction, "getOneUptimeUserIdFromTeamsUserId")
+      .mockResolvedValue(userId);
+    jest
+      .spyOn(
+        AccessTokenService,
+        "getDatabaseCommonInteractionPropsByUserAndProject",
+      )
+      .mockResolvedValue(databaseProps);
+    const getTeamIdsSpy: SpyInstance<
+      typeof TeamMemberService.getTeamIdsForUser
+    > = jest
+      .spyOn(TeamMemberService, "getTeamIdsForUser")
+      .mockResolvedValue(teamIds);
+    const handleIncidentSpy: SpyInstance<
+      typeof MicrosoftTeamsIncidentActions.handleBotIncidentAction
+    > = jest
+      .spyOn(MicrosoftTeamsIncidentActions, "handleBotIncidentAction")
+      .mockResolvedValue();
+
+    const turnContext: TurnContext = {
+      sendActivity: jest.fn(async (): Promise<void> => {}),
+    } as unknown as TurnContext;
+
+    await MicrosoftTeamsUtil.handleBotInvokeActivity({
+      activity: {
+        channelData: {
+          tenant: {
+            id: "connected-tenant-id",
+          },
+        },
+        from: {
+          aadObjectId: "linked-teams-user-aad-object-id",
+        },
+        value: {
+          action: MicrosoftTeamsIncidentActionType.AckIncident,
+          actionValue: ObjectID.generate().toString(),
+        },
+      },
+      turnContext: turnContext,
+    });
+
+    expect(getTeamIdsSpy).toHaveBeenCalledWith(userId, projectId);
+    expect(databaseProps.userTeamIds).toEqual(teamIds);
+    expect(handleIncidentSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        projectId: projectId,
+        oneUptimeUserId: userId,
+        databaseProps: expect.objectContaining({
+          userTeamIds: teamIds,
+        }),
+        turnContext: turnContext,
+      }),
+    );
+  });
+
+  test("does not load incident or alert permissions for an unrelated Bot action", async () => {
+    const projectId: ObjectID = ObjectID.generate();
+    const userId: ObjectID = ObjectID.generate();
+    const projectAuth: WorkspaceProjectAuthToken =
+      new WorkspaceProjectAuthToken();
+    projectAuth.projectId = projectId;
+
+    jest
+      .spyOn(MicrosoftTeamsUtil, "resolveProjectByTenantId")
+      .mockResolvedValue({
+        projectAuth: projectAuth,
+        isAmbiguous: false,
+        candidateProjectIds: [projectId],
+      });
+    jest
+      .spyOn(MicrosoftTeamsAuthAction, "getOneUptimeUserIdFromTeamsUserId")
+      .mockResolvedValue(userId);
+    const databasePropsSpy: SpyInstance<
+      typeof AccessTokenService.getDatabaseCommonInteractionPropsByUserAndProject
+    > = jest
+      .spyOn(
+        AccessTokenService,
+        "getDatabaseCommonInteractionPropsByUserAndProject",
+      )
+      .mockRejectedValue(new Error("unexpected permission lookup"));
+    const getTeamIdsSpy: SpyInstance<
+      typeof TeamMemberService.getTeamIdsForUser
+    > = jest
+      .spyOn(TeamMemberService, "getTeamIdsForUser")
+      .mockRejectedValue(new Error("unexpected team lookup"));
+    const handleMonitorSpy: SpyInstance<
+      typeof MicrosoftTeamsMonitorActions.handleBotMonitorAction
+    > = jest
+      .spyOn(MicrosoftTeamsMonitorActions, "handleBotMonitorAction")
+      .mockResolvedValue();
+    const turnContext: TurnContext = {
+      sendActivity: jest.fn(async (): Promise<void> => {}),
+    } as unknown as TurnContext;
+
+    await MicrosoftTeamsUtil.handleBotInvokeActivity({
+      activity: {
+        channelData: {
+          tenant: {
+            id: "connected-tenant-id",
+          },
+        },
+        from: {
+          aadObjectId: "linked-teams-user-aad-object-id",
+        },
+        value: {
+          action: MicrosoftTeamsMonitorActionType.ViewMonitor,
+          actionValue: ObjectID.generate().toString(),
+        },
+      },
+      turnContext: turnContext,
+    });
+
+    expect(databasePropsSpy).not.toHaveBeenCalled();
+    expect(getTeamIdsSpy).not.toHaveBeenCalled();
+    expect(handleMonitorSpy).toHaveBeenCalledTimes(1);
+  });
+});

package/Tests/Server/API/SessionReplayAPI.test.ts

@@ -7,6 +7,7 @@ import RumSessionReplayViewService from "../../../Server/Services/RumSessionRepl
 import RumSessionService from "../../../Server/Services/RumSessionService";
 import RumSessionChunkService from "../../../Server/Services/RumSessionChunkService";
 import { Statement } from "../../../Server/Utils/AnalyticsDatabase/Statement";
+import SessionReplayIdentity from "../../../Server/Utils/SessionReplay/SessionReplayIdentity";
 import RumApplication from "../../../Models/DatabaseModels/RumApplication";
 import RumSessionReplayView from "../../../Models/DatabaseModels/RumSessionReplayView";
 import Label from "../../../Models/DatabaseModels/Label";
@@ -1086,6 +1087,196 @@ describe("Session replay playback API", () => {
       expect(query).toContain("timeout_overflow_mode = 'throw'");
     });
 
+    /*
+     * Watching implies listing.
+     *
+     * RumSession's table read ACL contains ReadRumSessionReplayPayload for a
+     * reason it states outright: a role granted only the watch permission
+     * could fetch payloads - the payload routes authorize on it alone - while
+     * being 401'd on the manifest and the list, which is an incoherent grant
+     * rather than a safer one. The list guard did not mirror it, so the
+     * natural support-engineer role ("Watch Session Replays" + "Read RUM
+     * Application") got a permission error on the session list and a silently
+     * missing "Watch what the user saw" card on every exception page.
+     */
+    test("a caller with only the watch permission can still list sessions", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.ReadRumSessionReplayPayload],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      const result: CallResult = await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: { rumApplicationId: applicationAId.toString() },
+      });
+
+      expect(result.deniedWith).toBeUndefined();
+      expect(headerQuerySpy).toHaveBeenCalledTimes(1);
+    });
+
+    test("a Viewer still cannot list sessions", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.Viewer],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      const result: CallResult = await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: { rumApplicationId: applicationAId.toString() },
+      });
+
+      expect(result.deniedWith).toBeInstanceOf(NotAuthorizedException);
+      expect(headerQuerySpy).not.toHaveBeenCalled();
+    });
+
+    /*
+     * The identity filter takes the end-user REFERENCE a person can see in
+     * the list, and the server derives the digest with the same per-project
+     * HMAC the ingest used. It used to take the digest itself - a value
+     * displayed nowhere in the product and computed by no endpoint - so
+     * every input a human could plausibly type returned nothing.
+     */
+    test("an end-user reference is hashed server side before it reaches the query", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        /* Holds the narrower identity permission - see the gate test below. */
+        permissions: [Permission.ProjectOwner],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: {
+          rumApplicationId: applicationAId.toString(),
+          filters: { identifiedUserRef: "jane@example.com" },
+        },
+      });
+
+      const statement: Statement = headerQuerySpy.mock
+        .calls[0]![0] as Statement;
+
+      const expectedKey: string = SessionReplayIdentity.buildUserKey({
+        projectId: projectId,
+        userRef: "jane@example.com",
+      });
+
+      const bound: string = JSON.stringify(statement.query_params);
+
+      /* The raw reference must never reach the query. */
+      expect(bound).not.toContain("jane@example.com");
+      expect(bound).toContain(expectedKey);
+    });
+
+    /*
+     * The identity FILTER is gated by the same ACL as the identity COLUMN.
+     *
+     * Without this, a caller deliberately denied the label could still ask
+     * "does jane@example.com have sessions here" and read every other field
+     * of the answer - a dictionary attack that de-anonymises the list one
+     * candidate at a time, and hands back identifiedUserKey as a stable
+     * pseudonym to join against the route filter. It only became reachable
+     * once the ingest started populating the column; before that the
+     * predicate matched nothing whoever asked.
+     */
+    test("a caller without the identity permission cannot filter by end user", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        /* Can list, deliberately excluded from SESSION_REPLAY_IDENTITY_PERMISSIONS. */
+        permissions: [Permission.TelemetryAdmin],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: {
+          rumApplicationId: applicationAId.toString(),
+          filters: { identifiedUserRef: "jane@example.com" },
+        },
+      });
+
+      const statement: Statement = headerQuerySpy.mock
+        .calls[0]![0] as Statement;
+
+      const expectedKey: string = SessionReplayIdentity.buildUserKey({
+        projectId: projectId,
+        userRef: "jane@example.com",
+      });
+
+      /* Neither the reference nor its digest may reach the query. */
+      const bound: string = JSON.stringify(statement.query_params);
+
+      expect(bound).not.toContain("jane@example.com");
+      expect(bound).not.toContain(expectedKey);
+
+      /*
+       * aggIdentifiedUserKey is always a SELECT alias; what must be absent
+       * is the HAVING predicate over it.
+       */
+      expect(statement.query).not.toContain("aggIdentifiedUserKey =");
+    });
+
+    /*
+     * A filter the server cannot honour must be refused, not dropped. The
+     * silent-drop shape returns the WHOLE project's sessions with a 200 and
+     * gives the caller no way to tell that the person they asked about was
+     * not the one being answered about.
+     */
+    test("an unusable end-user reference is refused, not silently ignored", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.ProjectOwner],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      const result: CallResult = await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: {
+          rumApplicationId: applicationAId.toString(),
+          filters: { identifiedUserRef: "z".repeat(4096) },
+        },
+      });
+
+      expect(result.deniedWith).toBeInstanceOf(BadDataException);
+      expect(headerQuerySpy).not.toHaveBeenCalled();
+    });
+
     test("omits identifiedUserLabel for a caller without the narrower identity permission", async () => {
       const principal: {
         request: JSONObject;
@@ -1263,6 +1454,47 @@ describe("Session replay playback API", () => {
         "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount) > 0",
       );
     });
+
+    /*
+     * `false` means "sessions with NO frustration signals" and must be
+     * honoured, not dropped. The route admits any boolean and hasError /
+     * isFinalized beside it both honour false, so accepting the value and
+     * ignoring it returned the whole unfiltered list with a 200 and no
+     * indication why. The Dashboard never sends it, so this branch has no
+     * producer and this is its only cover.
+     */
+    test("hasFrustration false selects the clean sessions rather than being dropped", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.ProjectAdmin],
+      });
+
+      mockProps(principal.databaseProps);
+      mockApplication({ id: applicationAId, labelIds: [] });
+
+      await callRoute({
+        uri: LIST_ROUTE,
+        request: principal.request,
+        body: {
+          rumApplicationId: applicationAId.toString(),
+          filters: { hasFrustration: false },
+        },
+      });
+
+      const statement: Statement = headerQuerySpy.mock
+        .calls[0]![0] as Statement;
+
+      expect(statement.query).toContain(
+        "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount) = 0",
+      );
+      expect(statement.query).not.toContain(
+        "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount) > 0",
+      );
+    });
   });
 
   describe("manifest", () => {