@oneuptime/common 12.0.30 → 12.0.31

package/Tests/Server/Services/NetworkDeviceOidTemplateWriteGuards.test.ts

@@ -0,0 +1,409 @@
+import NetworkDeviceOidTemplateService from "../../../Server/Services/NetworkDeviceOidTemplateService";
+import { Service as NetworkDeviceServiceType } from "../../../Server/Services/NetworkDeviceService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../../../Server/Types/Database/Hooks";
+import NetworkDevice from "../../../Models/DatabaseModels/NetworkDevice";
+import NetworkDeviceOidTemplate from "../../../Models/DatabaseModels/NetworkDeviceOidTemplate";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import SnmpOid from "../../../Types/Monitor/SnmpMonitor/SnmpOid";
+import {
+  MAX_DEVICE_SPECIFIC_OIDS,
+  MAX_EFFECTIVE_OIDS_PER_DEVICE,
+} from "../../../Types/Monitor/SnmpMonitor/SnmpOidListUtil";
+import ObjectID from "../../../Types/ObjectID";
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * WHAT THIS FILE IS DEFENDING
+ *
+ * Two write guards on NetworkDevice, and specifically that they RUN.
+ *
+ * onBeforeUpdate has an early return: a write that changes neither the
+ * device's site nor its identity columns bails out before the expensive read
+ * it does not need. Both new guards were originally added below that return —
+ * which made them dead code for exactly the writes they exist for, because
+ * linking a template or editing snmpOids touches neither site nor identity.
+ * Nothing failed; the guards simply never ran, which is the worst shape a
+ * security check can take.
+ *
+ * So these tests do not just assert "a cross-project template is refused".
+ * They assert it through the real hook, on a payload that trips the early
+ * return, in both spellings the UI actually posts.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const TEMPLATE_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+const DEVICE_ID: ObjectID = new ObjectID(
+  "44444444-4444-4444-8444-444444444444",
+);
+
+type DeviceServiceInternals = {
+  onBeforeCreate: (
+    createBy: CreateBy<NetworkDevice>,
+  ) => Promise<OnCreate<NetworkDevice>>;
+  onBeforeUpdate: (
+    updateBy: UpdateBy<NetworkDevice>,
+  ) => Promise<OnUpdate<NetworkDevice>>;
+};
+
+function buildDeviceService(): {
+  service: NetworkDeviceServiceType;
+  internals: DeviceServiceInternals;
+} {
+  const service: NetworkDeviceServiceType = new NetworkDeviceServiceType();
+  return {
+    service,
+    internals: service as unknown as DeviceServiceInternals,
+  };
+}
+
+/*
+ * The device the update matches. Its projectId is what the guard compares the
+ * template against.
+ */
+function matchedDevice(): NetworkDevice {
+  const device: NetworkDevice = new NetworkDevice(DEVICE_ID);
+  device.projectId = PROJECT_ID;
+  return device;
+}
+
+function templateInProject(projectId: ObjectID): NetworkDeviceOidTemplate {
+  const template: NetworkDeviceOidTemplate = new NetworkDeviceOidTemplate(
+    TEMPLATE_ID,
+  );
+  template.projectId = projectId;
+  template.name = "Cisco Catalyst 9300";
+  return template;
+}
+
+/*
+ * A payload that links a template and NOTHING else — no site, no hostname, no
+ * name, no sysName. This is the shape the device settings form and the bulk
+ * action actually post, and it is precisely the shape that trips
+ * onBeforeUpdate's early return.
+ */
+function templateOnlyUpdate(
+  spelling: "id" | "relation",
+): UpdateBy<NetworkDevice> {
+  const data: Record<string, unknown> =
+    spelling === "id"
+      ? { oidTemplateId: TEMPLATE_ID }
+      : { oidTemplate: templateInProject(PROJECT_ID) };
+
+  return {
+    query: { _id: DEVICE_ID.toString() },
+    data: data,
+    props: { isRoot: true },
+  } as unknown as UpdateBy<NetworkDevice>;
+}
+
+describe("linking a device to an OID Collection Template is tenant-checked", () => {
+  /*
+   * Typed loosely: jest.spyOn's SpiedFunction and this repo's @types/jest
+   * disagree about the optionality of mock.lastCall, and these assertions
+   * only need mockResolvedValue and the call count.
+   */
+  let templateFindSpy: {
+    mockResolvedValue: (value: never) => unknown;
+    mock: { calls: Array<Array<unknown>> };
+  };
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    templateFindSpy = jest.spyOn(
+      NetworkDeviceOidTemplateService,
+      "findOneById",
+    ) as unknown as typeof templateFindSpy;
+  });
+
+  /*
+   * THE regression test. If the guard drifts back below the early return this
+   * resolves cleanly and the cross-project link is persisted, so the assertion
+   * has to be that the hook REJECTS — not merely that some code path exists.
+   */
+  test.each(["id", "relation"] as const)(
+    "refuses a template from another project when the payload writes only the %s",
+    async (spelling: "id" | "relation") => {
+      const { service, internals } = buildDeviceService();
+
+      jest
+        .spyOn(service, "findBy")
+        .mockResolvedValue([matchedDevice()] as never);
+      templateFindSpy.mockResolvedValue(
+        templateInProject(OTHER_PROJECT_ID) as never,
+      );
+
+      await expect(
+        internals.onBeforeUpdate(templateOnlyUpdate(spelling)),
+      ).rejects.toThrow(/must belong to the same project/);
+    },
+  );
+
+  test("allows a template from the device's own project", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([matchedDevice()] as never);
+    templateFindSpy.mockResolvedValue(templateInProject(PROJECT_ID) as never);
+
+    await expect(
+      internals.onBeforeUpdate(templateOnlyUpdate("id")),
+    ).resolves.toBeDefined();
+  });
+
+  /*
+   * The guard must actually reach the database rather than being skipped. A
+   * hook that returns early looks identical to a hook that passed, so assert
+   * the lookup happened.
+   */
+  test("actually looks the template up, rather than returning early", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([matchedDevice()] as never);
+    templateFindSpy.mockResolvedValue(templateInProject(PROJECT_ID) as never);
+
+    await internals.onBeforeUpdate(templateOnlyUpdate("id"));
+
+    expect(templateFindSpy.mock.calls.length).toBeGreaterThan(0);
+  });
+
+  test("refuses a template that does not exist at all", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([matchedDevice()] as never);
+    templateFindSpy.mockResolvedValue(null as never);
+
+    await expect(
+      internals.onBeforeUpdate(templateOnlyUpdate("id")),
+    ).rejects.toThrow(BadDataException);
+  });
+
+  test("does no template lookup for an update that links nothing", async () => {
+    const { internals } = buildDeviceService();
+
+    await internals.onBeforeUpdate({
+      query: { _id: DEVICE_ID.toString() },
+      data: { pollingIntervalInMinutes: 10 },
+      props: { isRoot: true },
+    } as unknown as UpdateBy<NetworkDevice>);
+
+    expect(templateFindSpy.mock.calls).toHaveLength(0);
+  });
+
+  test("checks the template on create too", async () => {
+    const { internals } = buildDeviceService();
+
+    templateFindSpy.mockResolvedValue(
+      templateInProject(OTHER_PROJECT_ID) as never,
+    );
+
+    const device: NetworkDevice = new NetworkDevice();
+    device.projectId = PROJECT_ID;
+    device.oidTemplateId = TEMPLATE_ID;
+
+    await expect(
+      internals.onBeforeCreate({
+        data: device,
+        props: { isRoot: true },
+      } as CreateBy<NetworkDevice>),
+    ).rejects.toThrow(/must belong to the same project/);
+  });
+});
+
+describe("device-specific OID validation runs on the write that carries it", () => {
+  function oidOnlyUpdate(oids: Array<SnmpOid>): UpdateBy<NetworkDevice> {
+    return {
+      query: { _id: DEVICE_ID.toString() },
+      data: { snmpOids: oids },
+      props: { isRoot: true },
+    } as unknown as UpdateBy<NetworkDevice>;
+  }
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * Same dead-code hazard as above: a snmpOids-only write changes neither
+   * site nor identity, so validation placed after the early return would
+   * never run on the only write that carries an OID list.
+   */
+  test("refuses a malformed OID on an snmpOids-only update", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([matchedDevice()] as never);
+
+    await expect(
+      internals.onBeforeUpdate(oidOnlyUpdate([{ oid: "sysUpTime.0" }])),
+    ).rejects.toThrow(/is not a numeric OID/);
+  });
+
+  function oidList(length: number): Array<SnmpOid> {
+    return Array.from({ length: length }, (_unused: unknown, index: number) => {
+      return { oid: `1.3.6.1.4.1.${index}` };
+    });
+  }
+
+  function linkedDevice(): NetworkDevice {
+    const device: NetworkDevice = matchedDevice();
+    device.oidTemplateId = TEMPLATE_ID;
+    return device;
+  }
+
+  /*
+   * The tight per-device budget is what ADOPTING a template costs, not a
+   * retroactive limit on every device that already exists.
+   *
+   * Enforcing it unconditionally would have locked a device that predates
+   * this feature, carrying a long hand-built list, out of saving ANY polling
+   * setting — the fleet in #3507 being the likeliest example, since it is the
+   * one with a hundred OIDs on it.
+   */
+  test("a device with no template may carry more than the device-specific budget", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([matchedDevice()] as never);
+
+    const result: OnUpdate<NetworkDevice> = await internals.onBeforeUpdate(
+      oidOnlyUpdate(oidList(MAX_DEVICE_SPECIFIC_OIDS + 1)),
+    );
+
+    expect(result.updateBy.data.snmpOids).toHaveLength(
+      MAX_DEVICE_SPECIFIC_OIDS + 1,
+    );
+  });
+
+  test("but never more than a device may effectively poll", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([matchedDevice()] as never);
+
+    await expect(
+      internals.onBeforeUpdate(
+        oidOnlyUpdate(oidList(MAX_EFFECTIVE_OIDS_PER_DEVICE + 1)),
+      ),
+    ).rejects.toThrow(
+      new RegExp(`more than the limit of ${MAX_EFFECTIVE_OIDS_PER_DEVICE}`),
+    );
+  });
+
+  /*
+   * Once a template IS linked, the two halves have to compose: the template
+   * budget plus the device-specific budget is the effective ceiling, so the
+   * device-specific half is what gives.
+   */
+  test("a LINKED device is held to the device-specific budget", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([linkedDevice()] as never);
+
+    await expect(
+      internals.onBeforeUpdate(
+        oidOnlyUpdate(oidList(MAX_DEVICE_SPECIFIC_OIDS + 1)),
+      ),
+    ).rejects.toThrow(
+      new RegExp(`more than the limit of ${MAX_DEVICE_SPECIFIC_OIDS}`),
+    );
+  });
+
+  /*
+   * And the same write that adopts a template is held to it immediately —
+   * otherwise the budget could be dodged by linking and editing in one call.
+   */
+  test("adopting a template in the same write applies the tighter budget at once", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([matchedDevice()] as never);
+    jest
+      .spyOn(NetworkDeviceOidTemplateService, "findOneById")
+      .mockResolvedValue(templateInProject(PROJECT_ID) as never);
+
+    await expect(
+      internals.onBeforeUpdate({
+        query: { _id: DEVICE_ID.toString() },
+        data: {
+          oidTemplateId: TEMPLATE_ID,
+          snmpOids: oidList(MAX_DEVICE_SPECIFIC_OIDS + 1),
+        },
+        props: { isRoot: true },
+      } as unknown as UpdateBy<NetworkDevice>),
+    ).rejects.toThrow(
+      new RegExp(`more than the limit of ${MAX_DEVICE_SPECIFIC_OIDS}`),
+    );
+  });
+
+  test("normalizes what it stores, so criteria can match with equality", async () => {
+    const { service, internals } = buildDeviceService();
+
+    jest.spyOn(service, "findBy").mockResolvedValue([matchedDevice()] as never);
+
+    const result: OnUpdate<NetworkDevice> = await internals.onBeforeUpdate(
+      oidOnlyUpdate([{ oid: ".1.3.6.1.4.1.9.1", name: "cpu" }]),
+    );
+
+    expect((result.updateBy.data.snmpOids as Array<SnmpOid>)[0]!.oid).toBe(
+      "1.3.6.1.4.1.9.1",
+    );
+  });
+
+  /*
+   * Linking a device whose STORED list already exceeds the device-specific
+   * budget would push the merge over the effective ceiling, and truncation
+   * drops from the end — so the operator's own OIDs would silently stop being
+   * polled, on a write that never mentioned them. Refuse the link instead,
+   * and say how many to trim.
+   */
+  test("refuses to link a device whose existing list already exceeds the linked budget", async () => {
+    const { service, internals } = buildDeviceService();
+
+    const crowdedDevice: NetworkDevice = matchedDevice();
+    crowdedDevice.snmpOids = oidList(MAX_DEVICE_SPECIFIC_OIDS + 5);
+
+    jest.spyOn(service, "findBy").mockResolvedValue([crowdedDevice] as never);
+    jest
+      .spyOn(NetworkDeviceOidTemplateService, "findOneById")
+      .mockResolvedValue(templateInProject(PROJECT_ID) as never);
+
+    await expect(
+      internals.onBeforeUpdate(templateOnlyUpdate("id")),
+    ).rejects.toThrow(/Remove 5 of them/);
+  });
+
+  test("allows the link when the existing list fits", async () => {
+    const { service, internals } = buildDeviceService();
+
+    const tidyDevice: NetworkDevice = matchedDevice();
+    tidyDevice.snmpOids = oidList(3);
+
+    jest.spyOn(service, "findBy").mockResolvedValue([tidyDevice] as never);
+    jest
+      .spyOn(NetworkDeviceOidTemplateService, "findOneById")
+      .mockResolvedValue(templateInProject(PROJECT_ID) as never);
+
+    await expect(
+      internals.onBeforeUpdate(templateOnlyUpdate("id")),
+    ).resolves.toBeDefined();
+  });
+
+  test("validates on create as well", async () => {
+    const { internals } = buildDeviceService();
+
+    const device: NetworkDevice = new NetworkDevice();
+    device.projectId = PROJECT_ID;
+    device.snmpOids = [{ oid: "not-an-oid" }];
+
+    await expect(
+      internals.onBeforeCreate({
+        data: device,
+        props: { isRoot: true },
+      } as CreateBy<NetworkDevice>),
+    ).rejects.toThrow(BadDataException);
+  });
+});

package/Tests/Server/Services/RuleEngineRuleFetchLimit.test.ts

@@ -0,0 +1,239 @@
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../../Utils/Rules/RuleEngineLimits";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import { describe, expect, it } from "@jest/globals";
+import fs from "fs";
+import path from "path";
+
+/*
+ * Every rule engine asks the same question when a resource is created -
+ * "which of this project's enabled rules match it?" - and every one of them
+ * used to ask it with `limit: 100, skip: 0`. That is not a page of a paged
+ * walk; it is the entire evaluation. A project with more rules than the cap
+ * silently never consulted the rest, which is how 1,243 monitor label rules
+ * produced roughly 50-100 labelled monitors out of 1,000+
+ * (OneUptime/oneuptime#3506).
+ *
+ * The fix is one shared constant, and this is the guard on it: the bug was a
+ * copy-paste that spread across 62 files, so the next engine copied from a
+ * sibling has to inherit the fix rather than the cap. Scanning the directory
+ * catches a new engine; asserting on the constant catches the cap being
+ * reintroduced under a different number.
+ *
+ * Raising the cap is only half of it. A read of `limit: <cap>, skip: 0` with
+ * no second page still cannot tell "that is all of them" from "that is all I
+ * was allowed to ask for", so an engine that reads rules must also REPORT
+ * hitting the ceiling. Without that, 10,000 is not a ceiling - it is the same
+ * cliff, further away. Both halves are asserted below.
+ */
+
+const SERVICES_DIRECTORY: string = path.resolve(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  "Server",
+  "Services",
+);
+
+interface RuleEngineSource {
+  /** Repo-relative-ish, so a failure message names something greppable. */
+  name: string;
+  contents: string;
+}
+
+/*
+ * Reads of a project's hand-authored rule config that do NOT carry the
+ * *RuleEngineService.ts suffix, and so were missed the first time the cap was
+ * lifted by filename. Five hang off IncidentService/AlertService
+ * onCreateSuccess and one off ScheduledMaintenanceService's - the same
+ * create-time chain, the same `limit: 100, skip: 0` shape, the same defect.
+ *
+ * Listed explicitly rather than matched by pattern: there is no naming
+ * convention that separates these from the hundreds of legitimate paged reads
+ * in the same directory, and a wrong pattern here would be a test that
+ * silently checks nothing.
+ */
+const OTHER_PROJECT_RULE_READS: Array<string> = [
+  "IncidentGroupingEngineService.ts",
+  "AlertGroupingEngineService.ts",
+  "IncidentSlaRuleService.ts",
+  "IncidentReminderRuleService.ts",
+  "AlertReminderRuleService.ts",
+  "ScheduledMaintenanceReminderRuleService.ts",
+];
+
+function readSource(fileName: string): RuleEngineSource {
+  return {
+    name: fileName,
+    contents: fs.readFileSync(path.join(SERVICES_DIRECTORY, fileName), "utf8"),
+  };
+}
+
+/*
+ * The engines that evaluate a project's configured rules. Named by
+ * convention, and the convention is what a new engine will be named too.
+ */
+function readRuleEngineSources(): Array<RuleEngineSource> {
+  return fs
+    .readdirSync(SERVICES_DIRECTORY)
+    .filter((fileName: string) => {
+      return fileName.endsWith("RuleEngineService.ts");
+    })
+    .map(readSource);
+}
+
+/*
+ * A file that reads a project's rules at all, and the shape of a limit that
+ * reads all of them. Hoisted rather than written inline: `/x/.test(y)` is a
+ * lint fight between `wrap-regex`, which wants parentheses, and prettier,
+ * which takes them straight back off.
+ */
+const RULE_FETCH_CALL: RegExp = /RuleService\.findBy\(|this\.findBy\(/;
+const WHOLE_PROJECT_LIMIT: RegExp =
+  /limit:\s*(MAX_RULES_EVALUATED_PER_PROJECT|LIMIT_PER_PROJECT|LIMIT_MAX)/;
+/*
+ * A read that advances an offset rather than always starting at zero, i.e.
+ * one that pages. Such a read cannot truncate, so it needs no ceiling report.
+ */
+const PAGED_READ: RegExp = /skip:\s*skip,/;
+
+/*
+ * Every `limit: <literal number>` in the file. Limits written as a named
+ * constant - MAX_RULES_EVALUATED_PER_PROJECT, LIMIT_PER_PROJECT, LIMIT_MAX,
+ * or a page size the file defines and documents - are deliberate; a bare
+ * number in a rule read is the shape of the bug.
+ */
+function numericLimits(source: string): Array<number> {
+  const matches: Array<string> = source.match(/limit:\s*\d+/g) || [];
+
+  return matches.map((match: string) => {
+    return Number(match.replace(/limit:\s*/, ""));
+  });
+}
+
+describe("MAX_RULES_EVALUATED_PER_PROJECT", () => {
+  it("is the codebase's existing whole-project bound", () => {
+    expect(MAX_RULES_EVALUATED_PER_PROJECT).toBe(LIMIT_PER_PROJECT);
+  });
+
+  /*
+   * 1,243 is the reporter's rule count. A ceiling that a real project has
+   * already walked up to is not a ceiling.
+   */
+  it("leaves room well past the rule counts that broke", () => {
+    expect(MAX_RULES_EVALUATED_PER_PROJECT).toBeGreaterThanOrEqual(10000);
+  });
+});
+
+describe("rule engines read every enabled rule in the project", () => {
+  const sources: Array<RuleEngineSource> = readRuleEngineSources();
+
+  it("finds the rule engines to check", () => {
+    expect(sources.length).toBeGreaterThan(50);
+  });
+
+  it.each(
+    sources.map((source: RuleEngineSource) => {
+      return [source.name, source] as [string, RuleEngineSource];
+    }),
+  )(
+    "%s does not cap its rule read at a bare number",
+    (_name: string, source: RuleEngineSource) => {
+      /*
+       * `limit: 1` is a single-row existence probe, not a rule evaluation, and
+       * a couple of engines legitimately use one. Anything else written as a
+       * literal is a cap on how much configuration gets evaluated.
+       */
+      const suspiciousLimits: Array<number> = numericLimits(
+        source.contents,
+      ).filter((limit: number) => {
+        return limit > 1 && limit < LIMIT_PER_PROJECT;
+      });
+
+      expect(suspiciousLimits).toEqual([]);
+    },
+  );
+
+  /*
+   * The read is `limit: <cap>, skip: 0` - there is no second page - so the
+   * cap has to be the whole-project one. An engine that fetches rules must
+   * say so with the shared constant.
+   */
+  it.each(
+    sources
+      .filter((source: RuleEngineSource) => {
+        return RULE_FETCH_CALL.test(source.contents);
+      })
+      .map((source: RuleEngineSource) => {
+        return [source.name, source] as [string, RuleEngineSource];
+      }),
+  )(
+    "%s fetches its rules with a whole-project limit",
+    (_name: string, source: RuleEngineSource) => {
+      expect(WHOLE_PROJECT_LIMIT.test(source.contents)).toBe(true);
+    },
+  );
+
+  /*
+   * The half that turns a cliff into a ceiling. `limit: <cap>, skip: 0`
+   * returns a full page whether or not more rows exist, so an engine that
+   * does not report the full page has merely relocated #3506 to a higher
+   * number.
+   *
+   * Two ways to satisfy that, and both are fine. Page to exhaustion, as
+   * NetworkDeviceAutoImportRuleEngineService.loadEnabledRules does - a read
+   * that keeps going until a short page proves the end has nothing left to
+   * truncate. Or read once and report a full result, which is what every
+   * other engine does. What is not fine is a single capped read that says
+   * nothing.
+   */
+  it.each(
+    sources
+      .filter((source: RuleEngineSource) => {
+        return RULE_FETCH_CALL.test(source.contents);
+      })
+      .map((source: RuleEngineSource) => {
+        return [source.name, source] as [string, RuleEngineSource];
+      }),
+  )(
+    "%s either pages its rule read to exhaustion or reports hitting the ceiling",
+    (_name: string, source: RuleEngineSource) => {
+      const pagesToExhaustion: boolean = PAGED_READ.test(source.contents);
+      const reportsCeiling: boolean =
+        source.contents.includes("logIfRuleReadWasTruncated({") &&
+        source.contents.includes("rulesRead:");
+
+      expect(pagesToExhaustion || reportsCeiling).toBe(true);
+    },
+  );
+});
+
+/*
+ * The same two properties for the rule reads that do not carry the
+ * *RuleEngineService.ts suffix. These were missed when the cap was first
+ * lifted, precisely because the fix was scoped by filename - which is the
+ * argument for listing them here by name rather than trusting a pattern.
+ */
+describe("project rule reads outside the *RuleEngineService.ts naming", () => {
+  const sources: Array<RuleEngineSource> =
+    OTHER_PROJECT_RULE_READS.map(readSource);
+
+  it.each(
+    sources.map((source: RuleEngineSource) => {
+      return [source.name, source] as [string, RuleEngineSource];
+    }),
+  )(
+    "%s reads its rules with a whole-project limit and reports the ceiling",
+    (_name: string, source: RuleEngineSource) => {
+      const suspiciousLimits: Array<number> = numericLimits(
+        source.contents,
+      ).filter((limit: number) => {
+        return limit > 1 && limit < LIMIT_PER_PROJECT;
+      });
+
+      expect(suspiciousLimits).toEqual([]);
+      expect(WHOLE_PROJECT_LIMIT.test(source.contents)).toBe(true);
+      expect(source.contents).toContain("logIfRuleReadWasTruncated({");
+    },
+  );
+});