@oneuptime/common 12.0.27 → 12.0.29

package/Tests/Server/Types/Database/Permissions/ApiKeyFileAccess.test.ts

@@ -0,0 +1,286 @@
+import { describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * PasswordHash has a known, pre-existing TS5.9 compile failure under ts-jest
+ * (Buffer vs BinaryLike) that breaks every suite whose import graph reaches
+ * it. APIKeyAccessPermission pulls in ApiKeyPermissionService, which reaches
+ * it; nothing here touches password hashing, so stub it before that graph is
+ * compiled. Same reason and same shape as the stub in
+ * Tests/Server/Utils/APIKey/AccessPermission.test.ts.
+ */
+jest.mock("../../../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: class PasswordHashStub {},
+  };
+});
+
+import DatabaseRequestType from "../../../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import CreatePermission from "../../../../../Server/Types/Database/Permissions/CreatePermission";
+import TenantPermission from "../../../../../Server/Types/Database/Permissions/TenantPermission";
+import APIKeyAccessPermission from "../../../../../Server/Utils/APIKey/AccessPermission";
+import AllModelTypes from "../../../../../Models/DatabaseModels/Index";
+import BaseModel from "../../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import File from "../../../../../Models/DatabaseModels/File";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import MimeType from "../../../../../Types/File/MimeType";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission, {
+  UserGlobalAccessPermission,
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../../Types/Permission";
+import UserType from "../../../../../Types/UserType";
+
+/*
+ * Contract under test: an API key is not a logged-in user, and File's gate must
+ * not treat it as one.
+ *
+ * File and FileModel gate on [CurrentUser, AuthenticatedRequest]. CurrentUser is
+ * auto-granted to every authenticated caller, so a key that holds nothing else
+ * from that list intersects down to CurrentUser alone — and that is exactly the
+ * condition TenantPermission.isAccessGrantedOnlyByCurrentUser reports as "this
+ * caller is here as nothing more than some logged-in user". A caller in that
+ * state is confined to rows they own, which a key can never be: it carries no
+ * userId, and both the query-side scope and the create-side ownership check
+ * reject it outright rather than run unscoped.
+ *
+ * Granting Permission.AuthenticatedRequest to API keys is what makes that
+ * predicate answer the truth. The permission exists for precisely this - it is a
+ * marker for "some authenticated principal made this call", not a capability an
+ * administrator grants, and File/FileModel are the only models that name it.
+ *
+ * Worth being exact about what is and is not broken today, because it decides
+ * what this test is for. File declares no user column, so
+ * CreatePermission.checkCreateOwnership returns before the userId guard and file
+ * creation by API key does NOT currently fail - the third test below pins that
+ * it passes both before and after. The predicate is still answering wrongly, and
+ * the moment File gains a user column, or a second model adopts the same
+ * [CurrentUser, AuthenticatedRequest] pair, the wrong answer stops being
+ * harmless. This suite pins the predicate itself rather than the symptom, so
+ * that the grant cannot be quietly dropped as unused.
+ */
+
+const projectId: ObjectID = ObjectID.generate();
+const userId: ObjectID = ObjectID.generate();
+
+/*
+ * The tenant half of an API key's permissions. getApiTenantAccessPermission
+ * returns the default baseline plus whatever rows the key was configured with;
+ * built here rather than called so the suite stays free of the service and its
+ * cache. A key with no configured rows is the interesting case - it is the one
+ * that has nothing but the auto-granted permissions to intersect with.
+ */
+function tenantPermissions(): UserTenantAccessPermission {
+  const permissions: Array<UserPermission> = [
+    Permission.CurrentUser,
+    Permission.UnAuthorizedSsoUser,
+  ].map((permission: Permission) => {
+    return {
+      permission: permission,
+      labelIds: [],
+      isBlockPermission: false,
+      _type: "UserPermission",
+    };
+  });
+
+  return {
+    projectId,
+    permissions,
+    isBlockPermission: false,
+    _type: "UserTenantAccessPermission",
+  };
+}
+
+function apiKeyProps(
+  globalPermissions: Array<Permission>,
+): DatabaseCommonInteractionProps {
+  return {
+    tenantId: projectId,
+    userType: UserType.API,
+    userGlobalAccessPermission: {
+      projectIds: [projectId],
+      globalPermissions: globalPermissions,
+      _type: "UserGlobalAccessPermission",
+    },
+    userTenantAccessPermission: {
+      [projectId.toString()]: tenantPermissions(),
+    },
+  } as unknown as DatabaseCommonInteractionProps;
+}
+
+/*
+ * The list as it stood before AuthenticatedRequest was granted. Kept literal
+ * rather than derived: it is the negative control, and a control that tracks the
+ * production list would silently stop controlling for anything.
+ */
+const GLOBAL_PERMISSIONS_WITHOUT_MARKER: Array<Permission> = [
+  Permission.Public,
+  Permission.User,
+  Permission.CurrentUser,
+];
+
+function newFile(): File {
+  const file: File = new File();
+  file.name = "screenshot.png";
+  file.fileType = MimeType.png;
+  file.file = Buffer.from("not-really-a-png");
+  file.isPublic = false;
+  return file;
+}
+
+/*
+ * Every model that names AuthenticatedRequest anywhere in its table or column
+ * access control, by model name.
+ */
+function modelsNamingTheMarker(): Array<string> {
+  const naming: Array<string> = [];
+
+  for (const modelType of AllModelTypes as Array<{ new (): BaseModel }>) {
+    const model: BaseModel = new modelType();
+
+    const permissions: Array<Permission> = [
+      ...(model.createRecordPermissions || []),
+      ...(model.readRecordPermissions || []),
+      ...(model.updateRecordPermissions || []),
+      ...(model.deleteRecordPermissions || []),
+    ];
+
+    for (const column of model.getTableColumns().columns) {
+      const accessControl: ReturnType<BaseModel["getColumnAccessControlFor"]> =
+        model.getColumnAccessControlFor(column);
+
+      if (!accessControl) {
+        continue;
+      }
+
+      permissions.push(
+        ...(accessControl.create || []),
+        ...(accessControl.read || []),
+        ...(accessControl.update || []),
+      );
+    }
+
+    if (permissions.includes(Permission.AuthenticatedRequest)) {
+      naming.push(modelType.name);
+    }
+  }
+
+  return naming.sort();
+}
+
+describe("API key access to File", () => {
+  test("no model other than File gates on the marker", () => {
+    /*
+     * The grant is unconditional - every API key in every project holds
+     * AuthenticatedRequest, and unlike a role permission no administrator can
+     * revoke it. What keeps that safe is not the grant but this list: the
+     * marker is deliberately absent from
+     * TenantPermission.AUTO_GRANTED_TENANT_PERMISSIONS, so any model that
+     * starts naming it hands every API key a role-grade way through its gate.
+     *
+     * Sweeping the models rather than trusting a grep is the point. A new
+     * model quietly adopting the [CurrentUser, AuthenticatedRequest] pair is
+     * the one change that turns this from bounded to unbounded, and it should
+     * fail here and be argued for rather than land unnoticed.
+     *
+     * This list must only ever shrink. A new entry needs its own review.
+     */
+    expect(modelsNamingTheMarker()).toEqual(["File"]);
+  });
+
+  test("the production global permission list carries the AuthenticatedRequest marker", async () => {
+    const permission: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    expect(permission.globalPermissions).toContain(
+      Permission.AuthenticatedRequest,
+    );
+  });
+
+  test("a key holding the marker is not mistaken for a bare logged-in user", async () => {
+    const permission: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    /*
+     * Driven off the real list rather than a copy of it: this is the assertion
+     * that fails if the grant is ever removed.
+     */
+    expect(
+      TenantPermission.isAccessGrantedOnlyByCurrentUser(
+        File,
+        apiKeyProps(permission.globalPermissions),
+        DatabaseRequestType.Create,
+      ),
+    ).toBe(false);
+
+    // The negative control: without the marker the predicate answers wrongly.
+    expect(
+      TenantPermission.isAccessGrantedOnlyByCurrentUser(
+        File,
+        apiKeyProps(GLOBAL_PERMISSIONS_WITHOUT_MARKER),
+        DatabaseRequestType.Create,
+      ),
+    ).toBe(true);
+  });
+
+  test("file creation by API key is allowed either way, because File has no user column", async () => {
+    /*
+     * Pinned deliberately. The PR that added the grant described this path as
+     * broken; it is not, and recording that here keeps the next reader from
+     * re-diagnosing a failure that was never happening. What holds it up is
+     * File declaring no user column - assert that too, so if File ever gains
+     * one this test says which assumption moved.
+     */
+    expect(new File().getUserColumn()).toBeFalsy();
+
+    const permission: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    expect(() => {
+      return CreatePermission.checkCreatePermissions(
+        File,
+        newFile(),
+        apiKeyProps(permission.globalPermissions),
+      );
+    }).not.toThrow();
+
+    expect(() => {
+      return CreatePermission.checkCreatePermissions(
+        File,
+        newFile(),
+        apiKeyProps(GLOBAL_PERMISSIONS_WITHOUT_MARKER),
+      );
+    }).not.toThrow();
+  });
+
+  test("a logged-in user still reaches File without the marker", () => {
+    /*
+     * AccessTokenService hands a user session [Public, User, CurrentUser] and no
+     * AuthenticatedRequest, so users continue to arrive through CurrentUser and
+     * are unaffected by the grant. Pinned because the asymmetry is deliberate
+     * and reads like an oversight otherwise.
+     */
+    const userProps: DatabaseCommonInteractionProps = {
+      tenantId: projectId,
+      userId: userId,
+      userType: UserType.User,
+      userGlobalAccessPermission: {
+        projectIds: [projectId],
+        globalPermissions: GLOBAL_PERMISSIONS_WITHOUT_MARKER,
+        _type: "UserGlobalAccessPermission",
+      },
+      userTenantAccessPermission: {
+        [projectId.toString()]: tenantPermissions(),
+      },
+    } as unknown as DatabaseCommonInteractionProps;
+
+    expect(() => {
+      return CreatePermission.checkCreatePermissions(
+        File,
+        newFile(),
+        userProps,
+      );
+    }).not.toThrow();
+  });
+});

package/Tests/Server/Types/Database/Permissions/MonitorTemplateColumnAccess.test.ts

@@ -0,0 +1,328 @@
+import QueryPermission from "../../../../../Server/Types/Database/Permissions/QueryPermission";
+import Query from "../../../../../Server/Types/Database/Query";
+import Select from "../../../../../Server/Types/Database/Select";
+import Monitor from "../../../../../Models/DatabaseModels/Monitor";
+import MonitorTemplate from "../../../../../Models/DatabaseModels/MonitorTemplate";
+import BaseModel from "../../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Includes from "../../../../../Types/BaseDatabase/Includes";
+import IsNull from "../../../../../Types/BaseDatabase/IsNull";
+import NotNull from "../../../../../Types/BaseDatabase/NotNull";
+import { TableColumnMetadata } from "../../../../../Types/Database/TableColumn";
+import TableColumnType from "../../../../../Types/Database/TableColumnType";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission from "../../../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * The server half of the monitor list's Template column and Template chip
+ * (issue #3491).
+ *
+ * Both of them are one line of UI and one permission rule, and the permission
+ * rule is the half that fails loudly for everybody at once:
+ *
+ *  - the column selects `monitorTemplate: { _id, templateName }`, and
+ *    QueryPermission.checkRelationQueryPermission THROWS on the first inner key
+ *    that is not marked `canReadOnRelationQuery` rather than dropping it — so a
+ *    missing flag does not hide the column, it fails the whole monitors list
+ *    request, for every caller up to ProjectOwner.
+ *
+ *  - the chip filters `monitorTemplateId`, and a WHERE clause is held to the
+ *    same standard as a SELECT: the column has to be one the caller may read,
+ *    or the list 403s the moment the chip is set.
+ *
+ * The selects and queries below are written out as literals rather than
+ * imported from the dashboard, so that changing the UI without changing the
+ * model surfaces here.
+ */
+
+const projectId: ObjectID = ObjectID.generate();
+const userId: ObjectID = ObjectID.generate();
+const templateId: ObjectID = ObjectID.generate();
+
+/*
+ * Fresh props per assertion: DatabaseCommonInteractionPropsUtil MUTATES what it
+ * is handed, pushing the auto-granted Public and CurrentUser onto the list, so
+ * a shared object carries state between tests.
+ */
+function makeProps(
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps {
+  return {
+    userId: userId,
+    tenantId: projectId,
+    userTenantAccessPermission: {
+      [projectId.toString()]: {
+        projectId: projectId,
+        permissions: permissions.map((permission: Permission) => {
+          return {
+            permission: permission,
+            labelIds: [],
+            isBlockPermission: false,
+            _type: "UserPermission" as const,
+          };
+        }),
+        _type: "UserTenantAccessPermission",
+      },
+    },
+  };
+}
+
+/**
+ * Everyone the monitor list is readable by. The failures this file guards
+ * against are in the permission layer and are not role-specific, so every
+ * assertion that matters is made across the whole read list rather than for one
+ * role — the on-call schedule regression this mirrors hit ProjectOwner too.
+ */
+const MONITOR_READERS: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.ProjectMember,
+  Permission.Viewer,
+  Permission.MonitorAdmin,
+  Permission.MonitorMember,
+  Permission.MonitorViewer,
+  Permission.ReadProjectMonitor,
+];
+
+/*
+ * The select the Template column declares in
+ * App/FeatureSet/Dashboard/src/Components/Monitor/MonitorTable.tsx, alongside
+ * the fields the rest of that table asks for.
+ */
+const MONITOR_TABLE_SELECT: Select<Monitor> = {
+  _id: true,
+  name: true,
+  monitorType: true,
+  monitorTemplate: {
+    _id: true,
+    templateName: true,
+  },
+} as Select<Monitor>;
+
+function checkRelationSelect(
+  select: Select<Monitor>,
+  props: DatabaseCommonInteractionProps,
+): void {
+  QueryPermission.checkRelationQueryPermission(
+    Monitor,
+    {} as Query<Monitor>,
+    select,
+    props,
+  );
+}
+
+function checkQuery(
+  query: Query<Monitor>,
+  props: DatabaseCommonInteractionProps,
+): void {
+  QueryPermission.checkQueryPermission(Monitor, query, props);
+}
+
+describe("selecting a monitor's template through the relation", () => {
+  it("accepts the monitor table's select", () => {
+    expect(() => {
+      return checkRelationSelect(
+        MONITOR_TABLE_SELECT,
+        makeProps([Permission.ProjectOwner]),
+      );
+    }).not.toThrow();
+  });
+
+  it("accepts it for every reader of the monitor list", () => {
+    for (const permission of MONITOR_READERS) {
+      expect(() => {
+        return checkRelationSelect(
+          MONITOR_TABLE_SELECT,
+          makeProps([permission]),
+        );
+      }).not.toThrow();
+    }
+  });
+
+  it("accepts the template name selected on its own", () => {
+    // Without `_id` alongside it, in case the cell stops linking to the template.
+    expect(() => {
+      return checkRelationSelect(
+        {
+          monitorTemplate: {
+            templateName: true,
+          },
+        } as Select<Monitor>,
+        makeProps([Permission.ProjectMember]),
+      );
+    }).not.toThrow();
+  });
+
+  /*
+   * The flag is what makes the select legal, and it is on the related model
+   * rather than on Monitor — so nothing in the dashboard or in Monitor.ts
+   * mentions it, and dropping it is an easy, silent edit.
+   */
+  it("is legal because templateName is readable through a relation", () => {
+    const template: BaseModel = new MonitorTemplate();
+    const metadata: TableColumnMetadata =
+      template.getTableColumnMetadata("templateName");
+
+    expect(metadata.canReadOnRelationQuery).toBe(true);
+    expect(metadata.type).toBe(TableColumnType.ShortText);
+  });
+
+  /*
+   * The relation traversal only recurses into Entity columns. If Monitor's
+   * `monitorTemplate` stopped being one, `monitorTemplate: { ... }` would no
+   * longer be a relation select at all and this whole gate would go vacuous.
+   */
+  it("travels a real Entity relation on Monitor", () => {
+    const monitor: BaseModel = new Monitor();
+    const metadata: TableColumnMetadata =
+      monitor.getTableColumnMetadata("monitorTemplate");
+
+    expect(metadata.type).toBe(TableColumnType.Entity);
+    expect(metadata.modelType).toBe(MonitorTemplate);
+    expect(metadata.manyToOneRelationColumn).toBe("monitorTemplateId");
+  });
+
+  /*
+   * The flag is not a blanket opening of the template table. A column that
+   * does not carry it still refuses, which is what keeps the surface to the
+   * one label the column renders.
+   */
+  it("still refuses a template column that is not marked for relation reads", () => {
+    expect(() => {
+      return checkRelationSelect(
+        {
+          monitorTemplate: {
+            monitorSteps: true,
+          },
+        } as Select<Monitor>,
+        makeProps([Permission.ProjectOwner]),
+      );
+    }).toThrow();
+  });
+
+  it("still refuses a column that does not exist on the template", () => {
+    expect(() => {
+      return checkRelationSelect(
+        {
+          monitorTemplate: {
+            noSuchColumn: true,
+          },
+        } as unknown as Select<Monitor>,
+        makeProps([Permission.ProjectOwner]),
+      );
+    }).toThrow();
+  });
+
+  it("still refuses a deep relation through the template", () => {
+    expect(() => {
+      return checkRelationSelect(
+        {
+          monitorTemplate: {
+            project: {
+              name: true,
+            },
+          },
+        } as unknown as Select<Monitor>,
+        makeProps([Permission.ProjectOwner]),
+      );
+    }).toThrow("You cannot query deep relations");
+  });
+});
+
+describe("filtering monitors by their template", () => {
+  /*
+   * The chip writes the foreign key. A WHERE clause reads a value as surely as
+   * a SELECT does, so this has to be a column the caller may read — otherwise
+   * setting the chip 403s a list that rendered fine a moment earlier.
+   */
+  it("accepts the chip's monitorTemplateId filter for every reader", () => {
+    for (const permission of MONITOR_READERS) {
+      expect(() => {
+        return checkQuery(
+          {
+            projectId: projectId,
+            monitorTemplateId: templateId,
+          } as Query<Monitor>,
+          makeProps([permission]),
+        );
+      }).not.toThrow();
+    }
+  });
+
+  it("accepts the multi-select form the chip actually sends", () => {
+    expect(() => {
+      return checkQuery(
+        {
+          projectId: projectId,
+          monitorTemplateId: new Includes([templateId, ObjectID.generate()]),
+        } as unknown as Query<Monitor>,
+        makeProps([Permission.ReadProjectMonitor]),
+      );
+    }).not.toThrow();
+  });
+
+  /*
+   * "Which monitors came from no template" — the rows the Template column
+   * renders as "—", and the ones a template rollout has not reached. Only the
+   * foreign key can be asked this: there is no template row to join against.
+   */
+  it("accepts the 'is empty' and 'is not empty' forms", () => {
+    expect(() => {
+      return checkQuery(
+        {
+          projectId: projectId,
+          monitorTemplateId: new IsNull(),
+        } as unknown as Query<Monitor>,
+        makeProps([Permission.ReadProjectMonitor]),
+      );
+    }).not.toThrow();
+
+    expect(() => {
+      return checkQuery(
+        {
+          projectId: projectId,
+          monitorTemplateId: new NotNull(),
+        } as unknown as Query<Monitor>,
+        makeProps([Permission.ReadProjectMonitor]),
+      );
+    }).not.toThrow();
+  });
+
+  it("filters a real, indexed column rather than a computed one", () => {
+    const monitor: BaseModel = new Monitor();
+    const metadata: TableColumnMetadata =
+      monitor.getTableColumnMetadata("monitorTemplateId");
+
+    expect(metadata.type).toBe(TableColumnType.ObjectID);
+    expect(monitor.getTableColumns().columns).toContain("monitorTemplateId");
+  });
+
+  /*
+   * The counterpart to the accept cases: the gate is really running, so the
+   * tests above pass because the column is readable rather than because
+   * nothing was checked.
+   */
+  it("still refuses a column that does not exist on Monitor", () => {
+    expect(() => {
+      return checkQuery(
+        {
+          projectId: projectId,
+          monitorTemplateName: "Production API Health",
+        } as unknown as Query<Monitor>,
+        makeProps([Permission.ProjectOwner]),
+      );
+    }).toThrow("Column does not exist");
+  });
+
+  it("refuses the filter for a caller with no read on monitors at all", () => {
+    expect(() => {
+      return checkQuery(
+        {
+          monitorTemplateId: templateId,
+        } as Query<Monitor>,
+        makeProps([Permission.ReadProjectIncident]),
+      );
+    }).toThrow();
+  });
+});

package/Tests/Server/Types/Database/QueryHelperFindWithSameTextAndIsNull.test.ts

@@ -0,0 +1,83 @@
+import QueryHelper from "../../../../Server/Types/Database/QueryHelper";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Fills the last two gaps in QueryHelper coverage that the sibling
+ * QueryHelper*.test.ts files leave untouched: the case-insensitive single-value
+ * `findWithSameText` and the parameterless `isNull` predicate.
+ *
+ * As with every QueryHelper operator, the SQL is produced by a function on the
+ * FindOperator's `.value`, given a column alias, and the comparand must live in
+ * the bound-parameter bag rather than the SQL text — these operators filter on
+ * user-typed / ingest-stamped identifiers, so an interpolated value would be an
+ * injection vector.
+ */
+
+interface RawOperator {
+  type: string;
+  objectLiteralParameters: Record<string, unknown>;
+  getSql: (aliasPath: string) => string;
+}
+
+function asRaw(operator: unknown): RawOperator {
+  return operator as unknown as RawOperator;
+}
+
+const ALIAS: string = '"Monitor"."name"';
+
+function paramValues(operator: RawOperator): Array<unknown> {
+  return Object.values(operator.objectLiteralParameters ?? {});
+}
+
+describe("QueryHelper.findWithSameText", () => {
+  it("wraps the column in LOWER() and lower-cases a string comparand", () => {
+    const op: RawOperator = asRaw(QueryHelper.findWithSameText("Production"));
+    const sql: string = op.getSql(ALIAS);
+
+    // A string comparison must be case-insensitive on BOTH sides.
+    expect(sql.toUpperCase()).toContain("LOWER(");
+    expect(sql).toContain(`LOWER(${ALIAS}) =`);
+
+    // Value is bound, lower-cased, never interpolated.
+    expect(sql).not.toContain("Production");
+    expect(sql).not.toContain("production");
+    expect(paramValues(op)).toEqual(["production"]);
+  });
+
+  it("trims surrounding whitespace off a string comparand", () => {
+    const op: RawOperator = asRaw(QueryHelper.findWithSameText("  Prod  "));
+    expect(paramValues(op)).toEqual(["prod"]);
+  });
+
+  it("compares a number without LOWER() and binds it as a string", () => {
+    const op: RawOperator = asRaw(QueryHelper.findWithSameText(42));
+    const sql: string = op.getSql(ALIAS);
+
+    // Numbers can't be lower-cased; the column must be compared directly.
+    expect(sql.toUpperCase()).not.toContain("LOWER(");
+    expect(sql).toContain(`(${ALIAS} =`);
+
+    // The value is still routed through the parameter bag, stringified.
+    expect(sql).not.toContain("42");
+    expect(paramValues(op)).toEqual(["42"]);
+  });
+
+  it("binds exactly one parameter", () => {
+    const op: RawOperator = asRaw(QueryHelper.findWithSameText("anything"));
+    expect(Object.keys(op.objectLiteralParameters)).toHaveLength(1);
+  });
+});
+
+describe("QueryHelper.isNull", () => {
+  it("emits IS NULL and binds nothing", () => {
+    const op: RawOperator = asRaw(QueryHelper.isNull());
+    const sql: string = op.getSql(ALIAS);
+
+    expect(sql.toUpperCase()).toContain("IS NULL");
+    expect(sql.toUpperCase()).not.toContain("IS NOT NULL");
+    expect(sql).toContain(ALIAS);
+
+    // A pure IS NULL predicate has no comparand to bind.
+    expect(Object.keys(op.objectLiteralParameters ?? {})).toHaveLength(0);
+  });
+});