@oneuptime/common 12.0.27 → 12.0.29

package/Tests/Server/Utils/AI/SRE/ConfidenceSignal.test.ts

@@ -0,0 +1,377 @@
+import AIConfidenceSignal, {
+  ConfidenceClassificationToken,
+  ConfidenceSignal,
+  ConfidenceSource,
+  EvidenceInput,
+} from "../../../../../Server/Utils/AI/SRE/ConfidenceSignal";
+import { AIChatCitation } from "../../../../../Types/AI/AIChatTypes";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * AI SRE confidence signal — the pure, LLM-free half of the module (the
+ * deterministic evidence floor, the defensive token parser, and the
+ * per-consumer decision helpers). These encode the safety-critical fail
+ * directions from the module header's decision table:
+ *
+ *   | source / verdict              | ping | instrumentation | auto code fix |
+ *   |-------------------------------|------|-----------------|---------------|
+ *   | deterministic-floor           | no   | yes             | no            |
+ *   | classification / CODE_FIX     | yes  | no              | yes           |
+ *   | classification / NO_CODE_FIX  | yes  | no              | no            |
+ *   | classification / INCONCLUSIVE | no   | yes             | no            |
+ *   | classification-failed         | YES  | no              | no            |
+ *
+ * The two load-bearing invariants these pin: (1) autonomous PR creation
+ * (instrumentation + auto code fix) fails toward doing nothing on a broken
+ * classifier, and (2) the on-call ping fails LOUDER — a broken classifier must
+ * never suppress it. Getting either direction backwards is the failure the
+ * threat model (vision §6) is written against, so it must not regress silently.
+ */
+
+function citation(rowCount: number): AIChatCitation {
+  return {
+    id: "C1",
+    toolName: "query_logs",
+    label: "logs",
+    queryArguments: {},
+    rowCount,
+  };
+}
+
+function signal(
+  source: ConfidenceSource,
+  confident: boolean,
+  codeFixRecommended?: boolean,
+): ConfidenceSignal {
+  return { source, confident, codeFixRecommended };
+}
+
+describe("AIConfidenceSignal.isDataBearingRowCount", () => {
+  test("a positive row count is data-bearing", () => {
+    expect(AIConfidenceSignal.isDataBearingRowCount(1)).toBe(true);
+    expect(AIConfidenceSignal.isDataBearingRowCount(1000)).toBe(true);
+  });
+
+  test("zero rows is server-verified but NOT data-bearing (proof of absence)", () => {
+    expect(AIConfidenceSignal.isDataBearingRowCount(0)).toBe(false);
+  });
+
+  test("null / undefined coalesce to zero → not data-bearing", () => {
+    expect(AIConfidenceSignal.isDataBearingRowCount(null)).toBe(false);
+    expect(AIConfidenceSignal.isDataBearingRowCount(undefined)).toBe(false);
+  });
+
+  test("a negative row count is not data-bearing", () => {
+    expect(AIConfidenceSignal.isDataBearingRowCount(-5)).toBe(false);
+  });
+});
+
+describe("AIConfidenceSignal.evidenceFromCitations", () => {
+  test("counts every citation but only data-bearing ones as data-bearing", () => {
+    const evidence: EvidenceInput = AIConfidenceSignal.evidenceFromCitations([
+      citation(3),
+      citation(0),
+      citation(7),
+    ]);
+
+    expect(evidence.citationCount).toBe(3);
+    expect(evidence.dataBearingToolCallCount).toBe(2);
+    expect(evidence.anyToolReturnedData).toBe(true);
+  });
+
+  test("citations that all returned zero rows count but bear no data", () => {
+    const evidence: EvidenceInput = AIConfidenceSignal.evidenceFromCitations([
+      citation(0),
+      citation(0),
+    ]);
+
+    expect(evidence.citationCount).toBe(2);
+    expect(evidence.dataBearingToolCallCount).toBe(0);
+    expect(evidence.anyToolReturnedData).toBe(false);
+  });
+
+  test("no citations → an all-zero evidence input", () => {
+    const evidence: EvidenceInput = AIConfidenceSignal.evidenceFromCitations(
+      [],
+    );
+
+    expect(evidence.citationCount).toBe(0);
+    expect(evidence.dataBearingToolCallCount).toBe(0);
+    expect(evidence.anyToolReturnedData).toBe(false);
+  });
+});
+
+describe("AIConfidenceSignal.hasVerifiableEvidence", () => {
+  test("true when any of the three signals is present", () => {
+    expect(
+      AIConfidenceSignal.hasVerifiableEvidence({
+        citationCount: 1,
+        dataBearingToolCallCount: 0,
+        anyToolReturnedData: false,
+      }),
+    ).toBe(true);
+
+    expect(
+      AIConfidenceSignal.hasVerifiableEvidence({
+        citationCount: 0,
+        dataBearingToolCallCount: 2,
+        anyToolReturnedData: false,
+      }),
+    ).toBe(true);
+
+    expect(
+      AIConfidenceSignal.hasVerifiableEvidence({
+        citationCount: 0,
+        dataBearingToolCallCount: 0,
+        anyToolReturnedData: true,
+      }),
+    ).toBe(true);
+  });
+
+  test("false only when the run minted nothing at all", () => {
+    expect(
+      AIConfidenceSignal.hasVerifiableEvidence({
+        citationCount: 0,
+        dataBearingToolCallCount: 0,
+        anyToolReturnedData: false,
+      }),
+    ).toBe(false);
+  });
+
+  test("a citation with zero data-bearing rows still passes the floor", () => {
+    // A tool that ran and proved absence is server-verified evidence.
+    const evidence: EvidenceInput = AIConfidenceSignal.evidenceFromCitations([
+      citation(0),
+    ]);
+    expect(AIConfidenceSignal.hasVerifiableEvidence(evidence)).toBe(true);
+  });
+});
+
+describe("AIConfidenceSignal.parseClassificationToken", () => {
+  test("recognises each of the three verdicts when it is the only one", () => {
+    expect(AIConfidenceSignal.parseClassificationToken("CODE_FIX")).toBe(
+      "CODE_FIX",
+    );
+    expect(AIConfidenceSignal.parseClassificationToken("NO_CODE_FIX")).toBe(
+      "NO_CODE_FIX",
+    );
+    expect(AIConfidenceSignal.parseClassificationToken("INCONCLUSIVE")).toBe(
+      "INCONCLUSIVE",
+    );
+  });
+
+  test("is case-insensitive", () => {
+    expect(AIConfidenceSignal.parseClassificationToken("code_fix")).toBe(
+      "CODE_FIX",
+    );
+    expect(AIConfidenceSignal.parseClassificationToken("Inconclusive")).toBe(
+      "INCONCLUSIVE",
+    );
+  });
+
+  test("tolerates editorializing prose around a single verdict", () => {
+    expect(
+      AIConfidenceSignal.parseClassificationToken(
+        "The verdict is CODE_FIX because the null check is missing.",
+      ),
+    ).toBe("CODE_FIX");
+  });
+
+  test("NO_CODE_FIX is not mis-read as CODE_FIX (underscore is a word char)", () => {
+    // Only NO_CODE_FIX appears as a whole word; CODE_FIX must not also match.
+    expect(AIConfidenceSignal.parseClassificationToken("NO_CODE_FIX")).toBe(
+      "NO_CODE_FIX",
+    );
+  });
+
+  test("multiple distinct verdicts → null (unparseable)", () => {
+    expect(
+      AIConfidenceSignal.parseClassificationToken("CODE_FIX or INCONCLUSIVE"),
+    ).toBeNull();
+  });
+
+  test("no verdict token → null", () => {
+    expect(
+      AIConfidenceSignal.parseClassificationToken("I am not sure what to say."),
+    ).toBeNull();
+  });
+
+  test("empty / null / undefined → null", () => {
+    expect(AIConfidenceSignal.parseClassificationToken("")).toBeNull();
+    expect(AIConfidenceSignal.parseClassificationToken(null)).toBeNull();
+    expect(AIConfidenceSignal.parseClassificationToken(undefined)).toBeNull();
+  });
+
+  test("word boundaries required — a substring inside another word does not match", () => {
+    // "PRECODE_FIXED" contains CODE_FIX as a substring but not as a word.
+    expect(
+      AIConfidenceSignal.parseClassificationToken("PRECODE_FIXED"),
+    ).toBeNull();
+  });
+});
+
+describe("AIConfidenceSignal.shouldSendWorkspaceNotification", () => {
+  test("classification-failed pings LOUDER regardless of the confident flag", () => {
+    expect(
+      AIConfidenceSignal.shouldSendWorkspaceNotification(
+        signal("classification-failed", false),
+      ),
+    ).toBe(true);
+    expect(
+      AIConfidenceSignal.shouldSendWorkspaceNotification(
+        signal("classification-failed", true),
+      ),
+    ).toBe(true);
+  });
+
+  test("otherwise it follows the confident flag", () => {
+    expect(
+      AIConfidenceSignal.shouldSendWorkspaceNotification(
+        signal("classification", true, true),
+      ),
+    ).toBe(true);
+    expect(
+      AIConfidenceSignal.shouldSendWorkspaceNotification(
+        signal("deterministic-floor", false, false),
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("AIConfidenceSignal.shouldEnqueueInstrumentationTask", () => {
+  test("classification-failed fails toward doing nothing", () => {
+    expect(
+      AIConfidenceSignal.shouldEnqueueInstrumentationTask(
+        signal("classification-failed", false),
+      ),
+    ).toBe(false);
+  });
+
+  test("enqueues on a positive inconclusive verdict (floor or classifier)", () => {
+    expect(
+      AIConfidenceSignal.shouldEnqueueInstrumentationTask(
+        signal("deterministic-floor", false, false),
+      ),
+    ).toBe(true);
+    expect(
+      AIConfidenceSignal.shouldEnqueueInstrumentationTask(
+        signal("classification", false, false),
+      ),
+    ).toBe(true);
+  });
+
+  test("does not enqueue when the run was confident", () => {
+    expect(
+      AIConfidenceSignal.shouldEnqueueInstrumentationTask(
+        signal("classification", true, true),
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("AIConfidenceSignal.isCodeFixRecommended / shouldAutoEnqueueCodeFixTask", () => {
+  test("requires classification source, confident, AND codeFixRecommended", () => {
+    const positive: ConfidenceSignal = signal("classification", true, true);
+    expect(AIConfidenceSignal.isCodeFixRecommended(positive)).toBe(true);
+    expect(AIConfidenceSignal.shouldAutoEnqueueCodeFixTask(positive)).toBe(
+      true,
+    );
+  });
+
+  test("NO_CODE_FIX (confident but not recommended) is insufficient", () => {
+    const noFix: ConfidenceSignal = signal("classification", true, false);
+    expect(AIConfidenceSignal.isCodeFixRecommended(noFix)).toBe(false);
+    expect(AIConfidenceSignal.shouldAutoEnqueueCodeFixTask(noFix)).toBe(false);
+  });
+
+  test("the deterministic floor never triggers an auto code fix", () => {
+    // Even if some caller mislabeled the floor as recommended, source gates it.
+    const floor: ConfidenceSignal = signal("deterministic-floor", false, true);
+    expect(AIConfidenceSignal.isCodeFixRecommended(floor)).toBe(false);
+  });
+
+  test("classification-failed never triggers an auto code fix", () => {
+    const failed: ConfidenceSignal = signal(
+      "classification-failed",
+      true,
+      true,
+    );
+    expect(AIConfidenceSignal.isCodeFixRecommended(failed)).toBe(false);
+  });
+
+  test("an absent (legacy) codeFixRecommended fails closed", () => {
+    const legacy: ConfidenceSignal = {
+      source: "classification",
+      confident: true,
+    };
+    expect(AIConfidenceSignal.isCodeFixRecommended(legacy)).toBe(false);
+  });
+});
+
+describe("AIConfidenceSignal decision table (cross-consumer)", () => {
+  interface Row {
+    signal: ConfidenceSignal;
+    ping: boolean;
+    instrumentation: boolean;
+    autoCodeFix: boolean;
+  }
+
+  const rows: Array<Row> = [
+    {
+      signal: signal("deterministic-floor", false, false),
+      ping: false,
+      instrumentation: true,
+      autoCodeFix: false,
+    },
+    {
+      signal: signal("classification", true, true),
+      ping: true,
+      instrumentation: false,
+      autoCodeFix: true,
+    },
+    {
+      signal: signal("classification", true, false),
+      ping: true,
+      instrumentation: false,
+      autoCodeFix: false,
+    },
+    {
+      signal: signal("classification", false, false),
+      ping: false,
+      instrumentation: true,
+      autoCodeFix: false,
+    },
+    {
+      signal: signal("classification-failed", false),
+      ping: true,
+      instrumentation: false,
+      autoCodeFix: false,
+    },
+  ];
+
+  test("every documented row maps to the three consumer decisions", () => {
+    for (const row of rows) {
+      const context: ConfidenceSource = row.signal.source;
+
+      expect({
+        context,
+        ping: AIConfidenceSignal.shouldSendWorkspaceNotification(row.signal),
+        instrumentation: AIConfidenceSignal.shouldEnqueueInstrumentationTask(
+          row.signal,
+        ),
+        autoCodeFix: AIConfidenceSignal.shouldAutoEnqueueCodeFixTask(
+          row.signal,
+        ),
+      }).toEqual({
+        context,
+        ping: row.ping,
+        instrumentation: row.instrumentation,
+        autoCodeFix: row.autoCodeFix,
+      });
+    }
+  });
+});
+
+// Keep the imported token type referenced for readers of this spec.
+const _tokenType: ConfidenceClassificationToken = "CODE_FIX";
+void _tokenType;

package/Tests/Server/Utils/APIKey/AccessPermission.test.ts

@@ -41,6 +41,15 @@ import { getJestSpyOn } from "../../../Spy";
  * key full control of the project; one that dropped it from the master path
  * would break trusted internal automation. Both directions are pinned below.
  *
+ * AuthenticatedRequest sits in the same list but is not a capability in that
+ * sense. It is the marker for "some authenticated principal made this call" -
+ * it has no PermissionProps, never appears in the admin picker, and no
+ * administrator can grant or revoke it (see PermissionCatalogueCoverage.test).
+ * Only File/FileModel name it, so what it widens is bounded by those two
+ * models. It is here so an API key is not mistaken for a bare logged-in user
+ * by TenantPermission.isAccessGrantedOnlyByCurrentUser - see
+ * ApiKeyFileAccess.test for the behaviour that depends on it.
+ *
  * getApiTenantAccessPermission also reshapes the (cached) permission rows into
  * the runtime UserPermission shape (labelIds carried over, block flag
  * preserved). That mapping is where a dropped label would quietly widen a
@@ -62,7 +71,7 @@ const permissionValues: (
 };
 
 describe("APIKeyAccessPermission.getDefaultApiGlobalPermission", () => {
-  it("grants Public, User and CurrentUser for the project", async () => {
+  it("grants Public, User, CurrentUser and AuthenticatedRequest for the project", async () => {
     const perm: UserGlobalAccessPermission =
       await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
 
@@ -72,10 +81,16 @@ describe("APIKeyAccessPermission.getDefaultApiGlobalPermission", () => {
         return p.toString();
       }),
     ).toEqual([projectId.toString()]);
+    /*
+     * Exact equality rather than four toContain calls: this list IS the
+     * privilege boundary, so an addition has to be argued for here rather than
+     * slipping in unnoticed.
+     */
     expect(perm.globalPermissions).toEqual([
       Permission.Public,
       Permission.User,
       Permission.CurrentUser,
+      Permission.AuthenticatedRequest,
     ]);
   });
 

package/Tests/Server/Utils/Greenlock/CertificateRenewalSchedule.test.ts

@@ -0,0 +1,250 @@
+/**
+ * Regression tests for status page certificate renewal scheduling.
+ *
+ * These pin the two properties whose absence let customer status pages serve
+ * expired certificates:
+ *
+ * - Renewal must be PROACTIVE. A run picks up a certificate weeks before it
+ *   expires. Previously renewal ran once a day over every certificate inside a
+ *   fixed window, strictly one domain at a time; once the fleet outgrew a
+ *   single run the queue stopped draining, and certificates were reordered only
+ *   after they had already expired and the provisioning sweep noticed the page
+ *   was serving a dead certificate.
+ *
+ * - Renewal must be SPREAD OUT. Let's Encrypt issues for 90 days, so domains
+ *   ordered together expire together. With one fixed lead time that batch stays
+ *   together forever and one bad run expires all of it at once. The lead time
+ *   is jittered per domain so batches disperse.
+ *
+ * A run is also capped, because the CA rate-limits new orders per account and
+ * the reactive sweep spends from the same allowance.
+ *
+ * AcmeCertificateService.findBy is spied on, so no database is touched, and
+ * orderCert is spied on so no ACME order is ever attempted.
+ */
+
+import GreenlockUtil from "../../../../Server/Utils/Greenlock/Greenlock";
+import AcmeCertificateService from "../../../../Server/Services/AcmeCertificateService";
+import AcmeCertificate from "../../../../Models/DatabaseModels/AcmeCertificate";
+import OneUptimeDate from "../../../../Types/Date";
+import { afterEach, describe, expect, test, jest } from "@jest/globals";
+
+function certificateExpiringInDays(
+  domain: string,
+  days: number,
+): AcmeCertificate {
+  return {
+    domain: domain,
+    expiresAt: OneUptimeDate.addRemoveDays(
+      OneUptimeDate.getCurrentDate(),
+      days,
+    ),
+  } as unknown as AcmeCertificate;
+}
+
+/*
+ * Drive a renewal run over a fixed set of certificates and report which domains
+ * it actually tried to order. The CNAME check is stubbed valid so the run
+ * reaches the order step for every domain it selects.
+ */
+async function domainsRenewedFor(
+  certificates: Array<AcmeCertificate>,
+): Promise<Array<string>> {
+  const ordered: Array<string> = [];
+
+  jest
+    .spyOn(AcmeCertificateService, "findBy")
+    .mockResolvedValue(certificates as never);
+
+  jest
+    .spyOn(GreenlockUtil, "orderCert")
+    .mockImplementation(async (data: { domain: string }): Promise<void> => {
+      ordered.push(data.domain);
+    });
+
+  await GreenlockUtil.renewAllCertsWhichAreExpiringSoon({
+    validateCname: async (): Promise<boolean> => {
+      return true;
+    },
+    notifyDomainRemoved: async (): Promise<void> => {
+      return undefined;
+    },
+  });
+
+  return ordered;
+}
+
+describe("Certificate renewal lead time", () => {
+  test("every domain renews well before it expires", () => {
+    const domains: Array<string> = [
+      "status.aleyant.com",
+      "status.example.com",
+      "a.status.syniti.com",
+      "b.status.avsw.io",
+      "x",
+      "",
+    ];
+
+    for (const domain of domains) {
+      const leadTime: number = GreenlockUtil.getRenewalLeadTimeInDays(domain);
+
+      expect(leadTime).toBeGreaterThanOrEqual(
+        GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS,
+      );
+      expect(leadTime).toBeLessThanOrEqual(
+        GreenlockUtil.RENEW_LEAD_TIME_MAX_IN_DAYS,
+      );
+    }
+  });
+
+  test("the shortest possible lead time still leaves days of margin", () => {
+    /*
+     * The whole point is that renewal happens before expiry, not at it. Even
+     * the least eager domain must have room for several failed runs.
+     */
+    expect(GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS).toBeGreaterThanOrEqual(7);
+  });
+
+  test("a domain's lead time is stable across calls", () => {
+    const first: number =
+      GreenlockUtil.getRenewalLeadTimeInDays("status.aleyant.com");
+    const second: number =
+      GreenlockUtil.getRenewalLeadTimeInDays("status.aleyant.com");
+
+    expect(first).toBe(second);
+  });
+
+  test("domains expiring on the same day do not all come due on the same day", () => {
+    /*
+     * The thundering herd: a batch ordered together must not renew together.
+     */
+    const leadTimes: Set<number> = new Set<number>();
+
+    for (let i: number = 0; i < 200; i++) {
+      leadTimes.add(
+        GreenlockUtil.getRenewalLeadTimeInDays(`status${i}.example.com`),
+      );
+    }
+
+    expect(leadTimes.size).toBeGreaterThan(1);
+  });
+});
+
+describe("Certificate renewal run", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("renews a certificate that is close to expiry", async () => {
+    const domain: string = "status.aleyant.com";
+
+    // one day left: due under any lead time in the range.
+    const renewed: Array<string> = await domainsRenewedFor([
+      certificateExpiringInDays(domain, 1),
+    ]);
+
+    expect(renewed).toEqual([domain]);
+  });
+
+  test("renews before expiry rather than after it", async () => {
+    /*
+     * This is the regression. A certificate with three weeks of life left is
+     * inside every domain's lead time, so a run must pick it up now - not wait
+     * until it has expired and the page is already broken.
+     */
+    const domain: string = "status.aleyant.com";
+
+    const renewed: Array<string> = await domainsRenewedFor([
+      certificateExpiringInDays(domain, 21),
+    ]);
+
+    expect(renewed).toEqual([domain]);
+  });
+
+  test("leaves a freshly issued certificate alone", async () => {
+    const renewed: Array<string> = await domainsRenewedFor([
+      certificateExpiringInDays("status.aleyant.com", 89),
+    ]);
+
+    expect(renewed).toEqual([]);
+  });
+
+  test("caps how many certificates one run orders", async () => {
+    /*
+     * A large backlog must not be dispatched as a single burst - the CA
+     * rate-limits new orders per account, and orders refused for rate limiting
+     * are renewals that did not happen.
+     */
+    const certificates: Array<AcmeCertificate> = Array.from(
+      { length: GreenlockUtil.RENEW_MAX_PER_RUN + 25 },
+      (_v: unknown, i: number) => {
+        return certificateExpiringInDays(`status${i}.example.com`, 1);
+      },
+    );
+
+    const renewed: Array<string> = await domainsRenewedFor(certificates);
+
+    expect(renewed).toHaveLength(GreenlockUtil.RENEW_MAX_PER_RUN);
+  });
+
+  test("spends a capped run on the certificates closest to expiring", async () => {
+    /*
+     * findBy returns rows sorted by expiry, and the cap is applied after the
+     * due filter - so the domains at the edge of expiry must be the ones a
+     * short run pays for, never the ones with weeks left.
+     */
+    const urgent: Array<AcmeCertificate> = Array.from(
+      { length: GreenlockUtil.RENEW_MAX_PER_RUN },
+      (_v: unknown, i: number) => {
+        return certificateExpiringInDays(`urgent${i}.example.com`, 1);
+      },
+    );
+
+    const lessUrgent: Array<AcmeCertificate> = Array.from(
+      { length: 10 },
+      (_v: unknown, i: number) => {
+        return certificateExpiringInDays(`later${i}.example.com`, 24);
+      },
+    );
+
+    const renewed: Array<string> = await domainsRenewedFor([
+      ...urgent,
+      ...lessUrgent,
+    ]);
+
+    for (const domain of renewed) {
+      expect(domain.startsWith("urgent")).toBe(true);
+    }
+  });
+
+  test("one domain that cannot be renewed does not abandon the rest of the run", async () => {
+    const ordered: Array<string> = [];
+
+    jest
+      .spyOn(AcmeCertificateService, "findBy")
+      .mockResolvedValue([
+        certificateExpiringInDays("broken.example.com", 1),
+        certificateExpiringInDays("healthy.example.com", 1),
+      ] as never);
+
+    jest
+      .spyOn(GreenlockUtil, "orderCert")
+      .mockImplementation(async (data: { domain: string }): Promise<void> => {
+        if (data.domain === "broken.example.com") {
+          throw new Error("CA refused the order");
+        }
+        ordered.push(data.domain);
+      });
+
+    await GreenlockUtil.renewAllCertsWhichAreExpiringSoon({
+      validateCname: async (): Promise<boolean> => {
+        return true;
+      },
+      notifyDomainRemoved: async (): Promise<void> => {
+        return undefined;
+      },
+    });
+
+    expect(ordered).toContain("healthy.example.com");
+  });
+});