@oneuptime/common 12.0.31 → 12.0.33

package/Tests/Server/Utils/IncomingCallPhoneNumber.test.ts

@@ -0,0 +1,174 @@
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+import ObjectID from "../../../Types/ObjectID";
+import API from "../../../Utils/API";
+import ClusterKeyAuthorization from "../../../Server/Middleware/ClusterKeyAuthorization";
+import logger from "../../../Server/Utils/Logger";
+import releaseIncomingCallPhoneNumber from "../../../Server/Utils/IncomingCallPhoneNumber";
+import { JSONObject } from "../../../Types/JSON";
+
+/*
+ * Releasing a provisioned incoming-call number when its config is deleted.
+ *
+ * The Common layer cannot reach the call provider itself, so this hands the
+ * release to the notification app's internal endpoint. It runs during cleanup,
+ * behind a delete the user has already asked for, and its whole contract is
+ * that it FAILS OPEN: the provider being unreachable, the notification app
+ * being mid-restart, or the endpoint answering 500 must all leave the parent
+ * delete to finish. A throw escaping here would leave the user's config
+ * undeletable for as long as the provider is unwell.
+ *
+ * The endpoint is internal and authenticated by cluster key rather than by a
+ * user, so the header is not optional decoration — a request without it is
+ * rejected and the number silently stays provisioned, which is a bill the
+ * project keeps paying for something it deleted.
+ */
+
+jest.mock("../../../Utils/API", () => {
+  return { __esModule: true, default: { post: jest.fn() } };
+});
+
+jest.mock("../../../Server/Middleware/ClusterKeyAuthorization", () => {
+  return {
+    __esModule: true,
+    default: { getClusterKeyHeaders: jest.fn() },
+  };
+});
+
+jest.mock("../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+    },
+  };
+});
+
+const api: { post: jest.Mock } = API as unknown as { post: jest.Mock };
+
+const clusterKey: { getClusterKeyHeaders: jest.Mock } =
+  ClusterKeyAuthorization as unknown as {
+    getClusterKeyHeaders: jest.Mock;
+  };
+
+const mockedLogger: { error: jest.Mock } = logger as unknown as {
+  error: jest.Mock;
+};
+
+const CONFIG_ID: ObjectID = ObjectID.generate();
+const PROVIDER_NUMBER_ID: string = "PN_provider_abc123";
+
+function callArgs(): JSONObject {
+  return api.post.mock.calls[0]![0] as JSONObject;
+}
+
+function release(): Promise<void> {
+  return releaseIncomingCallPhoneNumber({
+    projectCallSMSConfigId: CONFIG_ID,
+    callProviderPhoneNumberId: PROVIDER_NUMBER_ID,
+  });
+}
+
+describe("releaseIncomingCallPhoneNumber", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    api.post.mockResolvedValue(undefined as never);
+    clusterKey.getClusterKeyHeaders.mockReturnValue({
+      clusterkey: "test-cluster-key",
+    });
+  });
+
+  describe("the request it makes", () => {
+    test("posts to the notification app's internal release endpoint", async () => {
+      await release();
+
+      expect(api.post).toHaveBeenCalledTimes(1);
+      expect(callArgs()["url"]!.toString()).toContain(
+        "/api/notification/phone-number/internal/release",
+      );
+    });
+
+    /*
+     * Both ids are needed: the provider's own id says which number to hand
+     * back, and the config id is what the endpoint authorises the release
+     * against. Dropping either silently leaves the number provisioned.
+     */
+    test("names both the config and the provider's number", async () => {
+      await release();
+
+      const data: JSONObject = callArgs()["data"] as JSONObject;
+
+      expect(data["projectCallSMSConfigId"]).toBe(CONFIG_ID.toString());
+      expect(data["callProviderPhoneNumberId"]).toBe(PROVIDER_NUMBER_ID);
+    });
+
+    /*
+     * The id is sent as its string form, not as an ObjectID that would
+     * serialize to whatever JSON.stringify makes of the instance.
+     */
+    test("the config id is sent as a plain string", async () => {
+      await release();
+
+      expect(
+        typeof (callArgs()["data"] as JSONObject)["projectCallSMSConfigId"],
+      ).toBe("string");
+    });
+
+    /*
+     * An internal endpoint with no user behind it. Without the cluster key the
+     * request is rejected and the number stays provisioned - and because this
+     * function swallows failures, that rejection would be invisible.
+     */
+    test("carries the cluster key the internal endpoint authenticates on", async () => {
+      await release();
+
+      expect(clusterKey.getClusterKeyHeaders).toHaveBeenCalled();
+      expect((callArgs()["headers"] as JSONObject)["clusterkey"]).toBe(
+        "test-cluster-key",
+      );
+    });
+  });
+
+  describe("it fails open, so cleanup never blocks the delete", () => {
+    /*
+     * The parent delete has already been asked for. A provider or network
+     * problem during cleanup must not resurrect the row the user deleted.
+     */
+    test("a rejected request resolves rather than throwing", async () => {
+      api.post.mockRejectedValue(new Error("provider unreachable") as never);
+
+      await expect(release()).resolves.toBeUndefined();
+    });
+
+    test("the failure is logged rather than swallowed silently", async () => {
+      api.post.mockRejectedValue(new Error("provider unreachable") as never);
+
+      await release();
+
+      expect(mockedLogger.error).toHaveBeenCalled();
+    });
+
+    /*
+     * A synchronous throw while the request is still being assembled - a
+     * missing cluster key secret, say - is the same kind of cleanup failure
+     * and must not escape either.
+     */
+    test("a throw while building the request is caught too", async () => {
+      clusterKey.getClusterKeyHeaders.mockImplementation((): never => {
+        throw new Error("no cluster key configured");
+      });
+
+      await expect(release()).resolves.toBeUndefined();
+      expect(mockedLogger.error).toHaveBeenCalled();
+      expect(api.post).not.toHaveBeenCalled();
+    });
+
+    test("a successful release logs no error", async () => {
+      await release();
+
+      expect(mockedLogger.error).not.toHaveBeenCalled();
+    });
+  });
+});

package/Tests/Server/Utils/LoggerFaultDemotion.test.ts

@@ -0,0 +1,346 @@
+import ConfigLogLevel from "../../../Server/Types/ConfigLogLevel";
+import ErrorClass from "../../../Types/Telemetry/ErrorClass";
+import {
+  UNIT_OF_WORK_ATTRIBUTE_KEY,
+  UnitOfWork,
+} from "../../../Types/Telemetry/UnitOfWork";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import ServerException from "../../../Types/Exception/ServerException";
+import TimeoutException from "../../../Types/Exception/TimeoutException";
+import { SeverityNumber } from "@opentelemetry/api-logs";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * THE LOG HALF OF FAULT CLASSIFICATION.
+ *
+ * A log record goes to three places and they must be reasoned about
+ * separately: process stdout, the in-memory ring buffer the master-admin
+ * support bundle reads back, and the OpenTelemetry log exporter. The whole
+ * point of the demotion is that it changes only the THIRD one's severity —
+ * an operator staring at `docker logs` must still see "SMS notifications are
+ * not enabled for this project", because that line is how they discover a
+ * tenant misconfiguration.
+ */
+
+interface EmittedRecord {
+  body: string;
+  severityNumber?: SeverityNumber;
+  attributes?: Record<string, unknown> | undefined;
+}
+
+const emitted: Array<EmittedRecord> = [];
+
+jest.mock("../../../Server/Utils/Telemetry", () => {
+  return {
+    __esModule: true,
+    default: {
+      getLogger: (): unknown => {
+        return {
+          emit: (record: EmittedRecord): void => {
+            emitted.push(record);
+          },
+        };
+      },
+    },
+  };
+});
+
+import logger, { EXTERNAL_FAULT } from "../../../Server/Utils/Logger";
+import TelemetryContext from "../../../Server/Utils/Telemetry/TelemetryContext";
+
+function inUnitOfWork<T>(unitOfWork: UnitOfWork, fn: () => T): T {
+  return TelemetryContext.runWithContext(
+    { [UNIT_OF_WORK_ATTRIBUTE_KEY]: unitOfWork },
+    fn,
+  );
+}
+
+function lastEmitted(): EmittedRecord {
+  const record: EmittedRecord | undefined = emitted[emitted.length - 1];
+
+  if (!record) {
+    throw new Error("nothing was emitted to the OTel log exporter");
+  }
+
+  return record;
+}
+
+let consoleError: ReturnType<typeof jest.spyOn>;
+let consoleWarn: ReturnType<typeof jest.spyOn>;
+
+describe("Logger fault demotion", () => {
+  beforeEach((): void => {
+    emitted.length = 0;
+
+    /*
+     * LOG_LEVEL=ERROR is what config.example.env ships, so it is the setting
+     * most self-hosted Compose installs run. Every assertion here is made
+     * under it deliberately: it is the configuration in which a naive
+     * "route it through Logger.warn" implementation would silently delete
+     * these lines from stdout.
+     */
+    jest.spyOn(logger, "getLogLevel").mockReturnValue(ConfigLogLevel.ERROR);
+
+    consoleError = jest.spyOn(console, "error").mockImplementation((): void => {
+      return undefined;
+    });
+    consoleWarn = jest.spyOn(console, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+  });
+
+  afterEach((): void => {
+    jest.restoreAllMocks();
+  });
+
+  test("a user error inside a request is exported at WARN with error.class", () => {
+    inUnitOfWork(UnitOfWork.HttpRequest, (): void => {
+      logger.error(new BadDataException("Name is required"));
+    });
+
+    const record: EmittedRecord = lastEmitted();
+
+    expect(record.severityNumber).toBe(SeverityNumber.WARN);
+    expect(record.attributes?.["error.class"]).toBe(ErrorClass.UserError);
+    expect(record.body).toContain("Name is required");
+  });
+
+  test("an expected denial inside a request is exported at WARN", () => {
+    inUnitOfWork(UnitOfWork.HttpRequest, (): void => {
+      logger.error(new NotAuthenticatedException("token expired"));
+    });
+
+    expect(lastEmitted().severityNumber).toBe(SeverityNumber.WARN);
+    expect(lastEmitted().attributes?.["error.class"]).toBe(
+      ErrorClass.ExpectedDenial,
+    );
+  });
+
+  /*
+   * THE OPERATIONAL REGRESSION THIS GUARDS.
+   *
+   * Logger.warn is gated on DEBUG/INFO/WARN. Implementing the demotion as
+   * `return this.warn(...)` would therefore delete these lines from stdout AND
+   * from the support-bundle ring buffer on every install running
+   * LOG_LEVEL=ERROR — while looking correct on Helm, which ships INFO. The
+   * demotion keeps the ERROR-level GATE and lowers only the exported severity.
+   */
+  test("the line still reaches the console under LOG_LEVEL=ERROR", () => {
+    inUnitOfWork(UnitOfWork.HttpRequest, (): void => {
+      logger.error(new BadDataException("SMS is not enabled for this project"));
+    });
+
+    expect(consoleWarn).toHaveBeenCalled();
+    expect(consoleError).not.toHaveBeenCalled();
+  });
+
+  test("the line still reaches the support-bundle ring buffer", () => {
+    inUnitOfWork(UnitOfWork.HttpRequest, (): void => {
+      logger.error(new BadDataException("a very findable message"));
+    });
+
+    const messages: string = logger
+      .getRecentLogs()
+      .map((entry: { message: string }): string => {
+        return entry.message;
+      })
+      .join("\n");
+
+    expect(messages).toContain("a very findable message");
+  });
+
+  /*
+   * WARN is severityNumber 13; LogExceptionExtractor gates its stack-trace
+   * body scanner at 17. So the demotion also closes the log-derived exception
+   * path for these records — which matters because redactBody returns the FULL
+   * STACK STRING whenever redaction fired, and that stack otherwise parses
+   * straight into an Issue.
+   */
+  test("the exported severity is below the log-derived exception threshold", () => {
+    inUnitOfWork(UnitOfWork.HttpRequest, (): void => {
+      logger.error(new BadDataException("Name is required"));
+    });
+
+    const MIN_ERROR_SEVERITY_NUMBER: number = 17;
+    expect(Number(lastEmitted().severityNumber)).toBeLessThan(
+      MIN_ERROR_SEVERITY_NUMBER,
+    );
+  });
+});
+
+describe("Logger keeps real failures loud", () => {
+  beforeEach((): void => {
+    emitted.length = 0;
+    jest.spyOn(logger, "getLogLevel").mockReturnValue(ConfigLogLevel.ERROR);
+    consoleError = jest.spyOn(console, "error").mockImplementation((): void => {
+      return undefined;
+    });
+    consoleWarn = jest.spyOn(console, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+  });
+
+  afterEach((): void => {
+    jest.restoreAllMocks();
+  });
+
+  test.each([
+    [
+      "a plain Error",
+      (): unknown => {
+        return new Error("null is not an object");
+      },
+    ],
+    [
+      "a bare string",
+      (): unknown => {
+        return "something went very wrong";
+      },
+    ],
+    [
+      "a ServerException",
+      (): unknown => {
+        return new ServerException("boom");
+      },
+    ],
+    [
+      "a TimeoutException",
+      (): unknown => {
+        return new TimeoutException("timed out");
+      },
+    ],
+    [
+      "a JSON object",
+      (): unknown => {
+        return { what: "happened" };
+      },
+    ],
+  ])("%s stays at ERROR", (_name: string, make: () => unknown) => {
+    inUnitOfWork(UnitOfWork.HttpRequest, (): void => {
+      logger.error(make());
+    });
+
+    expect(lastEmitted().severityNumber).toBe(SeverityNumber.ERROR);
+    expect(consoleError).toHaveBeenCalled();
+    expect(consoleWarn).not.toHaveBeenCalled();
+  });
+
+  /*
+   * The unit-of-work promotion applies to logs exactly as it does to spans, so
+   * an internal invariant thrown as BadDataException from a worker job stays
+   * loud.
+   */
+  test("a user-error class escaping a worker job stays at ERROR", () => {
+    inUnitOfWork(UnitOfWork.WorkerJob, (): void => {
+      logger.error(new BadDataException("No job found with name: foo"));
+    });
+
+    expect(lastEmitted().severityNumber).toBe(SeverityNumber.ERROR);
+    expect(lastEmitted().attributes?.["error.class"]).toBe(
+      ErrorClass.CodeFault,
+    );
+  });
+
+  test("with no telemetry scope at all, a user-error class stays at ERROR", () => {
+    logger.error(new BadDataException("outside any scope"));
+
+    expect(lastEmitted().severityNumber).toBe(SeverityNumber.ERROR);
+  });
+
+  test("every ERROR record also carries error.class, so the field is always queryable", () => {
+    logger.error(new Error("plain"));
+
+    expect(lastEmitted().attributes?.["error.class"]).toBe(
+      ErrorClass.CodeFault,
+    );
+  });
+});
+
+describe("Logger EXTERNAL_FAULT", () => {
+  beforeEach((): void => {
+    emitted.length = 0;
+    jest.spyOn(logger, "getLogLevel").mockReturnValue(ConfigLogLevel.ERROR);
+    jest.spyOn(console, "error").mockImplementation((): void => {
+      return undefined;
+    });
+    consoleWarn = jest.spyOn(console, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+  });
+
+  afterEach((): void => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * The probe, notification and subscriber-fanout call sites log a plain
+   * STRING — there is no Error object to carry a tag — so they declare
+   * themselves through this attribute instead. It is a SITE-LEVEL declaration,
+   * so unlike a class default it survives the unit-of-work promotion: a probe
+   * check has no HTTP request around it, and a customer's endpoint being down
+   * is still not our defect.
+   */
+  test("a plain string stamped EXTERNAL_FAULT is demoted inside a probe check", () => {
+    inUnitOfWork(UnitOfWork.ProbeCheck, (): void => {
+      logger.error(
+        "Website Monitor - Pinging https://customer.example - ERROR: ECONNREFUSED",
+        EXTERNAL_FAULT,
+      );
+    });
+
+    expect(lastEmitted().severityNumber).toBe(SeverityNumber.WARN);
+    expect(lastEmitted().attributes?.["error.class"]).toBe(
+      ErrorClass.UserError,
+    );
+    expect(consoleWarn).toHaveBeenCalled();
+  });
+
+  test("the same string WITHOUT the stamp stays at ERROR", () => {
+    inUnitOfWork(UnitOfWork.ProbeCheck, (): void => {
+      logger.error(
+        "Website Monitor - Pinging https://customer.example - ERROR: ECONNREFUSED",
+      );
+    });
+
+    expect(lastEmitted().severityNumber).toBe(SeverityNumber.ERROR);
+  });
+
+  test("caller attributes are preserved alongside the stamp", () => {
+    inUnitOfWork(UnitOfWork.Notification, (): void => {
+      logger.error("SMTP auth failed for tenant", {
+        ...EXTERNAL_FAULT,
+        projectId: "abc-123",
+      });
+    });
+
+    expect(lastEmitted().attributes?.["projectId"]).toBe("abc-123");
+    expect(lastEmitted().attributes?.["error.class"]).toBe(
+      ErrorClass.UserError,
+    );
+  });
+
+  /*
+   * error.class must survive sanitizeAttributes, or the drop filters and
+   * dashboards built on it would silently see "[REDACTED]" instead. Nothing in
+   * SENSITIVE_KEY_FRAGMENTS matches "errorclass" or "user-error" today; this
+   * pins it so adding a fragment cannot break the field by accident.
+   */
+  test("error.class is never redacted by the attribute sanitizer", () => {
+    logger.error(new Error("plain"), { ...EXTERNAL_FAULT });
+
+    expect(lastEmitted().attributes?.["error.class"]).toBe(
+      ErrorClass.UserError,
+    );
+    expect(String(lastEmitted().attributes?.["error.class"])).not.toContain(
+      "REDACTED",
+    );
+  });
+});