@oneuptime/common 12.0.33 → 12.0.34

package/Tests/Server/API/UserNotificationSettingAPI.test.ts

@@ -0,0 +1,186 @@
+import { mockRouter } from "./Helpers";
+import CommonAPI from "../../../Server/API/CommonAPI";
+import UserNotificationSettingAPI from "../../../Server/API/UserNotificationSettingAPI";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import RoutineEmailSettingsService from "../../../Server/Services/RoutineEmailSettingsService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import { ROUTINE_EMAIL_EVENT_TYPES } from "../../../Types/NotificationSetting/RoutineEmailEvents";
+import ObjectID from "../../../Types/ObjectID";
+import Permission from "../../../Types/Permission";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+const ROUTE: string = "/user-notification-setting/reduce-routine-emails";
+const USER_ID: ObjectID = ObjectID.generate();
+const PROJECT_ID: ObjectID = ObjectID.generate();
+const OTHER_PROJECT_ID: ObjectID = ObjectID.generate();
+
+describe("POST reduce routine emails", () => {
+  let props: DatabaseCommonInteractionProps;
+  let reduceSpy: jest.SpyInstance;
+  let responseSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    props = {
+      userId: USER_ID,
+      tenantId: PROJECT_ID,
+      userTenantAccessPermission: {
+        [PROJECT_ID.toString()]: {
+          _type: "UserTenantAccessPermission",
+          projectId: PROJECT_ID,
+          permissions: [
+            {
+              _type: "UserPermission",
+              permission: Permission.ProjectMember,
+              labelIds: [],
+              isBlockPermission: false,
+            },
+          ],
+        },
+      },
+    };
+    jest
+      .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+      .mockImplementation(async () => {
+        return props;
+      });
+    reduceSpy = jest
+      .spyOn(RoutineEmailSettingsService, "reduceRoutineEmails")
+      .mockResolvedValue(undefined);
+    responseSpy = jest
+      .spyOn(Response, "sendJsonObjectResponse")
+      .mockImplementation(jest.fn());
+    mockRouter.routes = [];
+    new UserNotificationSettingAPI();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  async function call(body?: unknown): Promise<jest.Mock> {
+    const next: jest.Mock = jest.fn();
+    await mockRouter
+      .match("POST", ROUTE)
+      .handlerFunction(
+        { body, headers: {} } as ExpressRequest,
+        {} as ExpressResponse,
+        next as NextFunction,
+      );
+    return next;
+  }
+
+  test("requires user middleware and retains the existing settings CRUD routes", () => {
+    expect(mockRouter.match("POST", ROUTE).middleware).toBe(
+      UserMiddleware.getUserMiddleware,
+    );
+    expect(
+      mockRouter.match("POST", "/user-notification-setting"),
+    ).toBeDefined();
+    expect(
+      mockRouter.match("POST", "/user-notification-setting/get-list"),
+    ).toBeDefined();
+  });
+
+  test("lets a project member change their own preferences and returns the covered event count", async () => {
+    const next: jest.Mock = await call();
+    expect(next).not.toHaveBeenCalled();
+    expect(reduceSpy).toHaveBeenCalledWith({
+      userId: USER_ID,
+      projectId: PROJECT_ID,
+    });
+    expect(responseSpy).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      {
+        success: true,
+        routineEventTypeCount: ROUTINE_EMAIL_EVENT_TYPES.length,
+      },
+    );
+  });
+
+  test("ignores client-selected users, projects, channels and event lists", async () => {
+    await call({
+      userId: ObjectID.generate().toString(),
+      projectId: OTHER_PROJECT_ID.toString(),
+      tenantId: OTHER_PROJECT_ID.toString(),
+      alertByCall: false,
+      eventTypes: ["arbitrary event"],
+    });
+    expect(reduceSpy).toHaveBeenCalledTimes(1);
+    expect(reduceSpy).toHaveBeenCalledWith({
+      userId: USER_ID,
+      projectId: PROJECT_ID,
+    });
+  });
+
+  test.each(["anonymous", "project API key"])(
+    "rejects a %s without an authenticated user",
+    async () => {
+      props.userId = undefined;
+      const next: jest.Mock = await call({ userId: USER_ID.toString() });
+      expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+      expect(reduceSpy).not.toHaveBeenCalled();
+      expect(responseSpy).not.toHaveBeenCalled();
+    },
+  );
+
+  test("rejects missing project context before changing preferences", async () => {
+    props.tenantId = undefined;
+    const next: jest.Mock = await call({ projectId: PROJECT_ID.toString() });
+    expect(next).toHaveBeenCalledWith(expect.any(BadDataException));
+    expect(reduceSpy).not.toHaveBeenCalled();
+  });
+
+  test("rejects a logged-in user without project membership", async () => {
+    props.userTenantAccessPermission = undefined;
+    const next: jest.Mock = await call();
+    expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+    expect(reduceSpy).not.toHaveBeenCalled();
+  });
+
+  test("rejects membership in a different project", async () => {
+    props.tenantId = OTHER_PROJECT_ID;
+    const next: jest.Mock = await call();
+    expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+    expect(reduceSpy).not.toHaveBeenCalled();
+  });
+
+  test("does not report success when the transaction fails", async () => {
+    const error: Error = new Error("transaction failed");
+    reduceSpy.mockRejectedValue(error);
+    const next: jest.Mock = await call();
+    expect(next).toHaveBeenCalledWith(error);
+    expect(responseSpy).not.toHaveBeenCalled();
+  });
+
+  test("does not report success until the entire transaction commits", async () => {
+    let resolveTransaction: (() => void) | undefined;
+    reduceSpy.mockImplementation(() => {
+      return new Promise<void>((resolve: () => void) => {
+        resolveTransaction = resolve;
+      });
+    });
+    const request: Promise<jest.Mock> = call();
+    await Promise.resolve();
+    expect(reduceSpy).toHaveBeenCalledTimes(1);
+    expect(responseSpy).not.toHaveBeenCalled();
+    resolveTransaction!();
+    await request;
+    expect(responseSpy).toHaveBeenCalledTimes(1);
+  });
+});

package/Tests/Server/API/UserTelegramAPISecurity.test.ts

@@ -0,0 +1,231 @@
+import UserTelegramAPI from "../../../Server/API/UserTelegramAPI";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import VerificationCodeRateLimit from "../../../Server/Middleware/VerificationCodeRateLimit";
+import GlobalConfigService from "../../../Server/Services/GlobalConfigService";
+import UserTelegramService from "../../../Server/Services/UserTelegramService";
+import {
+  NextFunction,
+  OneUptimeRequest,
+  OneUptimeResponse,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import UserTelegram from "../../../Models/DatabaseModels/UserTelegram";
+import JSONWebTokenData from "../../../Types/JsonWebTokenData";
+import ObjectID from "../../../Types/ObjectID";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+  };
+});
+
+const VERIFICATION_INFO_ROUTE: string = "/user-telegram/verification-info";
+const RESEND_ROUTE: string = "/user-telegram/resend-verification-code";
+const USER_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const OTHER_USER_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const PROJECT_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "44444444-4444-4444-8444-444444444444",
+);
+const ITEM_ID: ObjectID = new ObjectID("55555555-5555-4555-8555-555555555555");
+
+function item(data: Partial<UserTelegram> = {}): UserTelegram {
+  const result: UserTelegram = new UserTelegram();
+  result.id = ITEM_ID;
+  result.userId = USER_ID;
+  result.projectId = PROJECT_ID;
+  result.isVerified = false;
+  Object.assign(result, data);
+  return result;
+}
+
+describe("UserTelegramAPI security", () => {
+  let request: OneUptimeRequest;
+  let response: OneUptimeResponse;
+  let next: NextFunction;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new UserTelegramAPI();
+  });
+
+  beforeEach(() => {
+    request = {
+      body: { itemId: ITEM_ID.toString() },
+      userAuthorization: { userId: USER_ID } as JSONWebTokenData,
+    } as OneUptimeRequest;
+    response = {
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as OneUptimeResponse;
+    next = jest.fn() as unknown as NextFunction;
+
+    jest
+      .spyOn(UserTelegramService, "findOneById")
+      .mockResolvedValue(item() as never);
+    jest
+      .spyOn(UserTelegramService, "hasActiveProjectMembership")
+      .mockResolvedValue(true);
+    jest
+      .spyOn(UserTelegramService, "getVerificationCode")
+      .mockResolvedValue("strong-token");
+    jest
+      .spyOn(UserTelegramService, "regenerateVerificationCode")
+      .mockResolvedValue("rotated-token");
+    jest.spyOn(GlobalConfigService, "findOneBy").mockResolvedValue({
+      telegramBotUsername: "oneuptime_bot",
+    } as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    jest.clearAllMocks();
+  });
+
+  async function call(route: string): Promise<void> {
+    await mockRouter
+      .match("post", route)
+      .handlerFunction(request, response, next);
+  }
+
+  test("both owner routes require an authenticated user", () => {
+    expect(
+      mockRouter.match("post", VERIFICATION_INFO_ROUTE).middlewares,
+    ).toContain(UserMiddleware.requireUserAuthentication);
+    expect(mockRouter.match("post", RESEND_ROUTE).middlewares).toContain(
+      UserMiddleware.requireUserAuthentication,
+    );
+  });
+
+  test("resend remains behind the shared verification rate limiter", () => {
+    expect(mockRouter.match("post", RESEND_ROUTE).middlewares).toHaveLength(3);
+    expect(mockRouter.match("post", RESEND_ROUTE).middlewares[2]).toBeDefined();
+    expect(typeof VerificationCodeRateLimit.getMiddleware).toBe("function");
+  });
+
+  test("verification info refuses an owned row after project membership is removed", async () => {
+    jest
+      .spyOn(UserTelegramService, "hasActiveProjectMembership")
+      .mockResolvedValue(false);
+
+    await call(VERIFICATION_INFO_ROUTE);
+
+    expect(UserTelegramService.hasActiveProjectMembership).toHaveBeenCalledWith(
+      {
+        projectId: PROJECT_ID,
+        userId: USER_ID,
+      },
+    );
+    expect(UserTelegramService.getVerificationCode).not.toHaveBeenCalled();
+    expect(Response.sendErrorResponse).toHaveBeenCalledWith(
+      request,
+      response,
+      expect.objectContaining({ message: "Item not found" }),
+    );
+  });
+
+  test("resend refuses an owned row after project membership is removed", async () => {
+    jest
+      .spyOn(UserTelegramService, "hasActiveProjectMembership")
+      .mockResolvedValue(false);
+
+    await call(RESEND_ROUTE);
+
+    expect(
+      UserTelegramService.regenerateVerificationCode,
+    ).not.toHaveBeenCalled();
+    expect(Response.sendErrorResponse).toHaveBeenCalledWith(
+      request,
+      response,
+      expect.objectContaining({ message: "Item not found" }),
+    );
+  });
+
+  test("uses the row project when the same user belongs to multiple projects", async () => {
+    jest
+      .spyOn(UserTelegramService, "findOneById")
+      .mockResolvedValue(item({ projectId: OTHER_PROJECT_ID }) as never);
+
+    await call(VERIFICATION_INFO_ROUTE);
+
+    expect(UserTelegramService.hasActiveProjectMembership).toHaveBeenCalledWith(
+      {
+        projectId: OTHER_PROJECT_ID,
+        userId: USER_ID,
+      },
+    );
+    expect(Response.sendJsonObjectResponse).toHaveBeenCalledWith(
+      request,
+      response,
+      expect.objectContaining({
+        verificationCode: "strong-token",
+        telegramBotUsername: "oneuptime_bot",
+      }),
+    );
+  });
+
+  test("does not let another authenticated user probe membership or rotate the token", async () => {
+    request.userAuthorization = {
+      userId: OTHER_USER_ID,
+    } as JSONWebTokenData;
+
+    await call(RESEND_ROUTE);
+
+    expect(
+      UserTelegramService.hasActiveProjectMembership,
+    ).not.toHaveBeenCalled();
+    expect(
+      UserTelegramService.regenerateVerificationCode,
+    ).not.toHaveBeenCalled();
+    expect(Response.sendErrorResponse).toHaveBeenCalledWith(
+      request,
+      response,
+      expect.objectContaining({ message: "Invalid user ID" }),
+    );
+  });
+
+  test("rotates only after ownership and exact project membership both pass", async () => {
+    await call(RESEND_ROUTE);
+
+    expect(UserTelegramService.hasActiveProjectMembership).toHaveBeenCalledWith(
+      {
+        projectId: PROJECT_ID,
+        userId: USER_ID,
+      },
+    );
+    expect(UserTelegramService.regenerateVerificationCode).toHaveBeenCalledWith(
+      ITEM_ID.toString(),
+    );
+    expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+      request,
+      response,
+    );
+  });
+});

package/Tests/Server/EnvironmentConfigFrontendSecurity.test.ts

@@ -0,0 +1,234 @@
+import { afterEach, describe, expect, test, jest } from "@jest/globals";
+import { JSONObject } from "../../Types/JSON";
+
+interface EnvironmentConfigShape {
+  getAllEnvVars: () => JSONObject;
+  getFrontendEnvVars: () => JSONObject;
+}
+
+const MANAGED_KEYS: Array<string> = [
+  "HOST",
+  "PUBLIC_TEST_SETTING",
+  "PRIVATE_TEST_SECRET",
+  "OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+  "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+  "PUBLIC_OTEL_EXPORTER_OTLP_HEADERS",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_TRACES_HEADERS",
+  "PUBLIC_OTEL_EXPORTER_OTLP_METRICS_HEADERS",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_LOGS_HEADERS",
+  "PUBLIC_OTEL_EXPORTER_OTLP_PROFILES_HEADERS",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_VENDOR_SIGNAL_HEADERS",
+  "PUBLIC_otel_exporter_otlp_traces_headers",
+  "PUBLIC_OTEL_EXPORTER_OTLP_HEADER_COUNT",
+  "PUBLIC_OTEL_EXPORTER_OTLP_HEADERS_ENABLED",
+  "PUBLIC_OTEL_EXPORTER_OTLP_HEADER",
+];
+
+const originalEnv: NodeJS.ProcessEnv = { ...process.env };
+
+async function load(
+  overrides: Record<string, string | undefined>,
+): Promise<EnvironmentConfigShape> {
+  for (const key of MANAGED_KEYS) {
+    delete process.env[key];
+  }
+
+  for (const [key, value] of Object.entries(overrides)) {
+    if (typeof value === "undefined") {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+
+  jest.resetModules();
+
+  return (await import(
+    "../../Server/EnvironmentConfig"
+  )) as unknown as EnvironmentConfigShape;
+}
+
+afterEach(() => {
+  process.env = { ...originalEnv };
+  jest.resetModules();
+});
+
+describe("frontend environment security boundary", () => {
+  test("keeps backend OTLP endpoint and headers out of the frontend snapshot", async () => {
+    const config: EnvironmentConfigShape = await load({
+      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT:
+        "https://collector.internal.example:4318",
+      OPENTELEMETRY_EXPORTER_OTLP_HEADERS:
+        "authorization=Bearer server-secret;x-oneuptime-token=server-key",
+    });
+
+    const frontend: JSONObject = config.getFrontendEnvVars();
+
+    expect(frontend).not.toHaveProperty("OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT");
+    expect(frontend).not.toHaveProperty("OPENTELEMETRY_EXPORTER_OTLP_HEADERS");
+    expect(JSON.stringify(frontend)).not.toContain("server-secret");
+    expect(JSON.stringify(frontend)).not.toContain("server-key");
+  });
+
+  test("still exposes ordinary explicitly allowed frontend settings", async () => {
+    const config: EnvironmentConfigShape = await load({
+      HOST: "status.example.com",
+    });
+
+    expect(config.getFrontendEnvVars()).toMatchObject({
+      HOST: "status.example.com",
+    });
+  });
+
+  test("still exposes ordinary PUBLIC_ settings", async () => {
+    const config: EnvironmentConfigShape = await load({
+      PUBLIC_TEST_SETTING: "safe-for-every-visitor",
+    });
+
+    expect(config.getFrontendEnvVars()).toMatchObject({
+      PUBLIC_TEST_SETTING: "safe-for-every-visitor",
+    });
+  });
+
+  test.each([
+    "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+    "PUBLIC_OTEL_EXPORTER_OTLP_HEADERS",
+    "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_TRACES_HEADERS",
+    "PUBLIC_OTEL_EXPORTER_OTLP_METRICS_HEADERS",
+    "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_LOGS_HEADERS",
+    "PUBLIC_OTEL_EXPORTER_OTLP_PROFILES_HEADERS",
+    "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_VENDOR_SIGNAL_HEADERS",
+    "PUBLIC_otel_exporter_otlp_traces_headers",
+  ])(
+    "rejects generic and signal-specific OTLP header alias %s",
+    async (key: string) => {
+      const secret: string = `authorization=Bearer secret-for-${key}`;
+      const config: EnvironmentConfigShape = await load({ [key]: secret });
+      const frontend: JSONObject = config.getFrontendEnvVars();
+
+      expect(frontend).not.toHaveProperty(key);
+      expect(JSON.stringify(frontend)).not.toContain(secret);
+    },
+  );
+
+  test.each([
+    "PUBLIC_OTEL_EXPORTER_OTLP_HEADER_COUNT",
+    "PUBLIC_OTEL_EXPORTER_OTLP_HEADERS_ENABLED",
+    "PUBLIC_OTEL_EXPORTER_OTLP_HEADER",
+  ])(
+    "does not over-match harmless near-miss public setting %s",
+    async (key: string) => {
+      const value: string = `non-secret-value-for-${key}`;
+      const config: EnvironmentConfigShape = await load({ [key]: value });
+
+      expect(config.getFrontendEnvVars()).toHaveProperty(key, value);
+    },
+  );
+
+  test("exposes only the separately named browser telemetry settings", async () => {
+    const config: EnvironmentConfigShape = await load({
+      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT:
+        "https://server-collector.internal:4318",
+      OPENTELEMETRY_EXPORTER_OTLP_HEADERS: "authorization=Bearer server-secret",
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT:
+        "https://browser-collector.example.com:4318",
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY:
+        "origin-bound-browser-key",
+    });
+
+    expect(config.getFrontendEnvVars()).toMatchObject({
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT:
+        "https://browser-collector.example.com:4318",
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY:
+        "origin-bound-browser-key",
+    });
+    expect(config.getFrontendEnvVars()).not.toHaveProperty(
+      "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+    );
+  });
+
+  test("does not include unrelated unallowlisted secrets", async () => {
+    const config: EnvironmentConfigShape = await load({
+      PRIVATE_TEST_SECRET: "do-not-publish-me",
+    });
+
+    expect(config.getFrontendEnvVars()).not.toHaveProperty(
+      "PRIVATE_TEST_SECRET",
+    );
+  });
+
+  test("omits unset telemetry settings", async () => {
+    const config: EnvironmentConfigShape = await load({});
+    const frontend: JSONObject = config.getFrontendEnvVars();
+
+    expect(frontend).not.toHaveProperty("OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT");
+    expect(frontend).not.toHaveProperty("OPENTELEMETRY_EXPORTER_OTLP_HEADERS");
+    expect(frontend).not.toHaveProperty(
+      "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+    );
+    expect(frontend).not.toHaveProperty(
+      "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY",
+    );
+  });
+
+  test("never publishes backend telemetry names even when Compose supplies blank values", async () => {
+    const config: EnvironmentConfigShape = await load({
+      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: "",
+      OPENTELEMETRY_EXPORTER_OTLP_HEADERS: "",
+    });
+
+    expect(config.getFrontendEnvVars()).not.toHaveProperty(
+      "OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+    );
+    expect(config.getFrontendEnvVars()).not.toHaveProperty(
+      "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+    );
+  });
+
+  test("preserves explicitly configured blank browser values without confusing them with server settings", async () => {
+    const config: EnvironmentConfigShape = await load({
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: "",
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY: "",
+    });
+
+    expect(config.getFrontendEnvVars()).toMatchObject({
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: "",
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY: "",
+    });
+  });
+
+  test("does not remove or mutate backend telemetry configuration in process.env", async () => {
+    const serverEndpoint: string = "https://collector.internal:4318";
+    const serverHeaders: string =
+      "authorization=Bearer unchanged-secret;x-tenant=production";
+    const config: EnvironmentConfigShape = await load({
+      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: serverEndpoint,
+      OPENTELEMETRY_EXPORTER_OTLP_HEADERS: serverHeaders,
+    });
+
+    config.getFrontendEnvVars();
+
+    expect(config.getAllEnvVars()).toMatchObject({
+      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: serverEndpoint,
+      OPENTELEMETRY_EXPORTER_OTLP_HEADERS: serverHeaders,
+    });
+    expect(process.env["OPENTELEMETRY_EXPORTER_OTLP_HEADERS"]).toBe(
+      serverHeaders,
+    );
+  });
+
+  test("returns a fresh snapshot so a caller cannot mutate process.env", async () => {
+    const config: EnvironmentConfigShape = await load({
+      HOST: "oneuptime.example.com",
+    });
+
+    const first: JSONObject = config.getFrontendEnvVars();
+    first["HOST"] = "attacker.example.com";
+
+    expect(config.getFrontendEnvVars()["HOST"]).toBe("oneuptime.example.com");
+    expect(process.env["HOST"]).toBe("oneuptime.example.com");
+  });
+});