@oneuptime/common 12.0.28 → 12.0.29

package/Tests/Types/API/HTTPResponse.test.ts

@@ -0,0 +1,175 @@
+import HTTPResponse from "../../../Types/API/HTTPResponse";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * HTTPResponse's constructor picks one of four shapes for the incoming body
+ * (paginated list, plain array, string, plain object) and its status-code
+ * predicates classify the response. Response.test.ts covers only the happy
+ * object/array path, so the list-detection branch, the hasMore flag, the
+ * string branch, and every predicate were previously untested.
+ */
+describe("HTTPResponse", () => {
+  describe("constructor - plain object body", () => {
+    it("stores a single object as jsonData and data", () => {
+      const response: HTTPResponse<JSONObject> = new HTTPResponse(
+        200,
+        { name: "oneuptime" },
+        {},
+      );
+
+      expect(response.statusCode).toBe(200);
+      expect(response.jsonData).toEqual({ name: "oneuptime" });
+      expect(response.data).toEqual({ name: "oneuptime" });
+      // A plain object body is not a list, so pagination stays at defaults.
+      expect(response.count).toBe(0);
+      expect(response.skip).toBe(0);
+      expect(response.limit).toBe(0);
+      expect(response.hasMore).toBeUndefined();
+    });
+
+    it("keeps the provided headers", () => {
+      const response: HTTPResponse<JSONObject> = new HTTPResponse(
+        200,
+        { ok: true },
+        { "content-type": "application/json" },
+      );
+
+      expect(response.headers).toEqual({ "content-type": "application/json" });
+    });
+  });
+
+  describe("constructor - array body", () => {
+    it("stores an array as jsonData without touching pagination", () => {
+      const response: HTTPResponse<Array<JSONObject>> = new HTTPResponse(
+        200,
+        [{ id: 1 }, { id: 2 }],
+        {},
+      );
+
+      expect(response.jsonData).toEqual([{ id: 1 }, { id: 2 }]);
+      expect(response.data).toEqual([{ id: 1 }, { id: 2 }]);
+      expect(response.count).toBe(0);
+    });
+  });
+
+  describe("constructor - paginated list body", () => {
+    it("extracts count, skip, limit and the nested data array", () => {
+      const listData: JSONObject = {
+        count: 42,
+        skip: 10,
+        limit: 20,
+        data: [{ id: "a" }, { id: "b" }] as JSONArray,
+      };
+
+      const response: HTTPResponse<Array<JSONObject>> = new HTTPResponse(
+        200,
+        listData,
+        {},
+      );
+
+      expect(response.count).toBe(42);
+      expect(response.skip).toBe(10);
+      expect(response.limit).toBe(20);
+      expect(response.jsonData).toEqual([{ id: "a" }, { id: "b" }]);
+      // hasMore is absent from the body, so it must remain undefined.
+      expect(response.hasMore).toBeUndefined();
+    });
+
+    it("reads hasMore when the list body carries it", () => {
+      const listData: JSONObject = {
+        count: 5,
+        skip: 0,
+        limit: 5,
+        hasMore: true,
+        data: [] as JSONArray,
+      };
+
+      const response: HTTPResponse<Array<JSONObject>> = new HTTPResponse(
+        200,
+        listData,
+        {},
+      );
+
+      expect(response.hasMore).toBe(true);
+      expect(response.jsonData).toEqual([]);
+    });
+
+    it("preserves hasMore === false as a real value, not a default", () => {
+      const listData: JSONObject = {
+        count: 3,
+        skip: 0,
+        limit: 10,
+        hasMore: false,
+        data: [{ id: 1 }] as JSONArray,
+      };
+
+      const response: HTTPResponse<Array<JSONObject>> = new HTTPResponse(
+        200,
+        listData,
+        {},
+      );
+
+      expect(response.hasMore).toBe(false);
+    });
+
+    it("does not treat an object missing one pagination key as a list", () => {
+      // count + skip but no limit => plain object branch, no pagination parse.
+      const response: HTTPResponse<JSONObject> = new HTTPResponse(
+        200,
+        { count: 9, skip: 0, data: [{ id: 1 }] as JSONArray },
+        {},
+      );
+
+      expect(response.count).toBe(0);
+      expect(response.skip).toBe(0);
+      expect(response.limit).toBe(0);
+      // The whole object is kept as jsonData since it was not a list.
+      expect(response.jsonData).toEqual({
+        count: 9,
+        skip: 0,
+        data: [{ id: 1 }],
+      });
+    });
+  });
+
+  describe("status code predicates", () => {
+    const makeResponse: (statusCode: number) => HTTPResponse<JSONObject> = (
+      statusCode: number,
+    ): HTTPResponse<JSONObject> => {
+      return new HTTPResponse<JSONObject>(statusCode, { ok: true }, {});
+    };
+
+    it("isSuccess is true only for 200", () => {
+      expect(makeResponse(200).isSuccess()).toBe(true);
+      expect(makeResponse(201).isSuccess()).toBe(false);
+      expect(makeResponse(404).isSuccess()).toBe(false);
+    });
+
+    it("isFailure is the inverse of a 200 response", () => {
+      expect(makeResponse(200).isFailure()).toBe(false);
+      expect(makeResponse(500).isFailure()).toBe(true);
+      expect(makeResponse(201).isFailure()).toBe(true);
+    });
+
+    it("isNotAuthorized is true only for 401", () => {
+      expect(makeResponse(401).isNotAuthorized()).toBe(true);
+      expect(makeResponse(403).isNotAuthorized()).toBe(false);
+    });
+
+    it("isTooManyRequests is true only for 429", () => {
+      expect(makeResponse(429).isTooManyRequests()).toBe(true);
+      expect(makeResponse(400).isTooManyRequests()).toBe(false);
+    });
+
+    it("isPaymentDeclined is true only for 402", () => {
+      expect(makeResponse(402).isPaymentDeclined()).toBe(true);
+      expect(makeResponse(200).isPaymentDeclined()).toBe(false);
+    });
+
+    it("isServerError is true only for 500", () => {
+      expect(makeResponse(500).isServerError()).toBe(true);
+      expect(makeResponse(502).isServerError()).toBe(false);
+    });
+  });
+});

package/Tests/Types/API/Route.test.ts

@@ -2,7 +2,7 @@ import Route from "../../../Types/API/Route";
 import BadDataException from "../../../Types/Exception/BadDataException";
 
 describe("Route", () => {
-  test("new Route() should throw an error if invalid route is passed", () => {
+  test("new Route() should throw an error if invalid characters are passed", () => {
     expect(() => {
       return new Route("api test");
     }).toThrowError(BadDataException);
@@ -16,15 +16,47 @@ describe("Route", () => {
       return new Route("/api|test");
     }).toThrowError(BadDataException);
   });
-  test("new Route() should throw an error if invalid route is passed", () => {
-    const route: Route = new Route("/api/test");
+
+  test.each([
+    "javascript:alert(document.domain)",
+    "JaVaScRiPt:alert(1)",
+    "data:text/plain,hello",
+    "vbscript:msgbox(1)",
+    "file:/etc/passwd",
+    "http://evil.example/path",
+    "https://evil.example/path",
+    "mailto:user@example.com",
+    "custom+scheme:value",
+  ])("rejects scheme-like route %s", (routeValue: string) => {
     expect(() => {
-      route.route = "api`test";
+      return new Route(routeValue);
     }).toThrowError(BadDataException);
   });
+
+  test.each(["api`test", "javascript:alert(document.domain)"])(
+    "route assignment rejects invalid value %s",
+    (routeValue: string) => {
+      const route: Route = new Route("/api/test");
+
+      expect(() => {
+        route.route = routeValue;
+      }).toThrowError(BadDataException);
+    },
+  );
+
   test("Route.toString() should return valid string", () => {
     expect(new Route("/api/test").toString()).toBe("/api/test");
     expect(new Route("/api#test").toString()).toBe("/api#test");
     expect(new Route("/api-test").toString()).toBe("/api-test");
   });
+
+  test.each([
+    "/status-page/:statusPageId/incidents",
+    "api/:resourceId",
+    "/events?at=12:30",
+    "/callback?next=custom:value",
+    "/literal/javascript:alert(1)",
+  ])("preserves legitimate colon use in %s", (routeValue: string) => {
+    expect(new Route(routeValue).toString()).toBe(routeValue);
+  });
 });

package/Tests/Types/Database/DatabaseProperty.test.ts

@@ -0,0 +1,171 @@
+import DatabaseProperty from "../../../Types/Database/DatabaseProperty";
+import NotImplementedException from "../../../Types/Exception/NotImplementedException";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import { describe, expect, it } from "@jest/globals";
+import { Equal, FindOperator, In, Not } from "typeorm";
+import { ValueTransformer } from "typeorm/decorator/options/ValueTransformer";
+
+/*
+ * DatabaseProperty is the base every value-object column type extends. Its
+ * TypeORM ValueTransformer carries three pieces of behavior that are easy to
+ * break and expensive to break:
+ *
+ *   - `to(undefined)` must stay `undefined` so an omitted column falls to its
+ *     SQL DEFAULT instead of being rewritten to an explicit NULL (a not-null
+ *     constraint violation / HTTP 500 on every create otherwise).
+ *   - a Raw query object must pass straight through untouched.
+ *   - a FindOperator (Equal/In/Not/And/...) must keep its structure while its
+ *     leaf value(s) are converted, so a privacy/scope clause is preserved.
+ *
+ * DatabasePropertyFindOperator.test.ts checks the concrete subclasses. This
+ * suite pins the base-class dispatch itself, using a tiny subclass whose
+ * conversion is observable (uppercasing).
+ */
+
+// A minimal concrete DatabaseProperty whose conversions are observable.
+class UpperCaseProperty extends DatabaseProperty {
+  public value: string;
+
+  public constructor(value: string) {
+    super();
+    this.value = value;
+  }
+
+  protected static override fromDatabase(
+    value: string | number | JSONObject | JSONArray,
+  ): DatabaseProperty | Array<DatabaseProperty> | null {
+    return new UpperCaseProperty(String(value));
+  }
+
+  protected static override toDatabase(
+    value: DatabaseProperty | Array<DatabaseProperty> | any,
+  ): string | number | JSONObject | JSONArray | null {
+    if (value instanceof UpperCaseProperty) {
+      return value.value.toUpperCase();
+    }
+
+    if (typeof value === "string") {
+      return value.toUpperCase();
+    }
+
+    return null;
+  }
+}
+
+describe("DatabaseProperty", () => {
+  describe("getDatabaseTransformer().to", () => {
+    it("passes undefined through unchanged so the SQL DEFAULT survives", () => {
+      const transformer: ValueTransformer =
+        UpperCaseProperty.getDatabaseTransformer();
+
+      // The whole point: undefined must NOT become null here.
+      expect(transformer.to(undefined)).toBeUndefined();
+    });
+
+    it("delegates a plain value to the subclass toDatabase", () => {
+      const transformer: ValueTransformer =
+        UpperCaseProperty.getDatabaseTransformer();
+
+      expect(transformer.to(new UpperCaseProperty("hello"))).toBe("HELLO");
+    });
+
+    it("passes a raw query object straight through without conversion", () => {
+      const transformer: ValueTransformer =
+        UpperCaseProperty.getDatabaseTransformer();
+
+      const raw: JSONObject = { _type: "raw", value: "keep me as-is" };
+      const result: unknown = transformer.to(raw);
+
+      // Same object, untouched - toDatabase (which uppercases) never ran.
+      expect(result).toBe(raw);
+      expect((result as JSONObject)["value"]).toBe("keep me as-is");
+    });
+
+    it("preserves an Equal FindOperator and converts only its leaf", () => {
+      const transformer: ValueTransformer =
+        UpperCaseProperty.getDatabaseTransformer();
+
+      const operator: FindOperator<string> = Equal("abc");
+      const result: unknown = transformer.to(operator);
+
+      // Structure kept (same instance), leaf converted.
+      expect(result).toBe(operator);
+      expect((result as FindOperator<string>).value).toBe("ABC");
+    });
+
+    it("preserves a Not FindOperator and converts its leaf", () => {
+      const transformer: ValueTransformer =
+        UpperCaseProperty.getDatabaseTransformer();
+
+      const operator: FindOperator<string> = Not("nope");
+      const result: unknown = transformer.to(operator);
+
+      expect(result).toBe(operator);
+      expect((result as FindOperator<string>).value).toBe("NOPE");
+    });
+
+    it("converts every leaf of a multi-value In FindOperator", () => {
+      const transformer: ValueTransformer =
+        UpperCaseProperty.getDatabaseTransformer();
+
+      const operator: FindOperator<Array<string>> = In(["a", "b", "c"]);
+      const result: unknown = transformer.to(operator);
+
+      expect(result).toBe(operator);
+      expect((result as FindOperator<Array<string>>).value).toEqual([
+        "A",
+        "B",
+        "C",
+      ]);
+    });
+
+    it("is a fixpoint: transforming its own output again is a no-op", () => {
+      const transformer: ValueTransformer =
+        UpperCaseProperty.getDatabaseTransformer();
+
+      const operator: FindOperator<string> = Equal("abc");
+      transformer.to(operator);
+      // Second pass (BaseAPI.getList shares the query between findBy/countBy).
+      transformer.to(operator);
+
+      expect(operator.value).toBe("ABC");
+    });
+  });
+
+  describe("getDatabaseTransformer().from", () => {
+    it("delegates to the subclass fromDatabase", () => {
+      const transformer: ValueTransformer =
+        UpperCaseProperty.getDatabaseTransformer();
+
+      const result: unknown = transformer.from("stored");
+
+      expect(result).toBeInstanceOf(UpperCaseProperty);
+      expect((result as UpperCaseProperty).value).toBe("stored");
+    });
+  });
+
+  describe("base class defaults", () => {
+    it("getSchema throws NotImplementedException on the base class", () => {
+      expect(() => {
+        return DatabaseProperty.getSchema();
+      }).toThrow(NotImplementedException);
+    });
+
+    it("still short-circuits undefined even on the un-implemented base", () => {
+      const transformer: ValueTransformer =
+        DatabaseProperty.getDatabaseTransformer();
+
+      // Reaches the undefined guard before the un-implemented toDatabase.
+      expect(transformer.to(undefined)).toBeUndefined();
+    });
+
+    it("throws NotImplementedException when the base must actually convert", () => {
+      const transformer: ValueTransformer =
+        DatabaseProperty.getDatabaseTransformer();
+
+      expect(() => {
+        return transformer.to("a real value");
+      }).toThrow(NotImplementedException);
+    });
+  });
+});