@oneuptime/common 12.0.33 → 12.0.34

package/Tests/Server/Utils/EmailRollup/EmailRollupFlushRunnerPreferences.test.ts

@@ -0,0 +1,362 @@
+import UserNotificationSettingService from "../../../../Server/Services/UserNotificationSettingService";
+import EmailRollupFlushRunner, {
+  RollupSweepStats,
+} from "../../../../Server/Utils/EmailRollup/EmailRollupFlushRunner";
+import { CLAIM_EPOCH_MINUTES } from "../../../../Server/Utils/EmailRollup/EmailRollupConstants";
+import { RollupBatchStatus } from "../../../../Models/DatabaseModels/UserNotificationEmailRollupBatch";
+import OneUptimeDate from "../../../../Types/Date";
+import Email from "../../../../Types/Email";
+import RollupCategory from "../../../../Types/NotificationSetting/NotificationEmailRollupCategory";
+import NotificationSettingEventType from "../../../../Types/NotificationSetting/NotificationSettingEventType";
+import ObjectID from "../../../../Types/ObjectID";
+import {
+  FakeItemRow,
+  FakeRow,
+  RollupHarness,
+  SentRollupMail,
+  emptyRollupHarness,
+  installRollupHarness,
+  pendingItems,
+  seedItem,
+  seedNotificationSetting,
+  seedProject,
+  seedVerifiedEmail,
+} from "./EmailRollupTestHarness";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const USER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "44444444-4444-4444-8444-444444444444",
+);
+const OTHER_USER_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+const TO_EMAIL: Email = new Email("owner@example.com");
+const OTHER_EMAIL: Email = new Email("second-owner@example.com");
+const NOW: Date = OneUptimeDate.fromString("2026-09-03T17:07:30.000Z");
+const CREATED_EVENT: NotificationSettingEventType =
+  NotificationSettingEventType.SEND_INCIDENT_CREATED_OWNER_NOTIFICATION;
+const STATE_CHANGED_EVENT: NotificationSettingEventType =
+  NotificationSettingEventType.SEND_INCIDENT_STATE_CHANGED_OWNER_NOTIFICATION;
+const ALERT_EVENT: NotificationSettingEventType =
+  NotificationSettingEventType.SEND_ALERT_CREATED_OWNER_NOTIFICATION;
+
+describe("EmailRollupFlushRunner - preferences changed while email is queued", () => {
+  let harness: RollupHarness;
+
+  beforeEach(() => {
+    harness = emptyRollupHarness();
+    installRollupHarness(harness);
+    seedProject(harness, { projectId: PROJECT_ID, name: "Acme" });
+    seedVerifiedEmail(harness, {
+      projectId: PROJECT_ID,
+      userId: USER_ID,
+      email: TO_EMAIL,
+    });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function seedDue(
+    data: {
+      subject?: string | undefined;
+      eventType?: NotificationSettingEventType | undefined;
+      rollupCategory?: RollupCategory | undefined;
+      projectId?: ObjectID | undefined;
+      userId?: ObjectID | undefined;
+      toEmail?: Email | undefined;
+    } = {},
+  ): FakeItemRow {
+    return seedItem(harness, {
+      projectId: data.projectId ?? PROJECT_ID,
+      userId: data.userId ?? USER_ID,
+      toEmail: data.toEmail ?? TO_EMAIL,
+      createdAt: OneUptimeDate.addRemoveMinutes(NOW, -12),
+      subject: data.subject,
+      eventType: data.eventType,
+      rollupCategory: data.rollupCategory,
+    });
+  }
+
+  function getSetting(eventType: NotificationSettingEventType): FakeRow {
+    return harness.notificationSettings.find((row: FakeRow): boolean => {
+      return (
+        row["eventType"] === eventType &&
+        String(row["projectId"]) === PROJECT_ID.toString() &&
+        String(row["userId"]) === USER_ID.toString()
+      );
+    })!;
+  }
+
+  test("a mixed batch omits muted events and reports only delivered notifications", async () => {
+    seedDue({ subject: "Checkout is down" });
+    seedDue({
+      subject: "Muted incident state change",
+      eventType: STATE_CHANGED_EVENT,
+    });
+    seedDue({
+      subject: "CPU is high",
+      eventType: ALERT_EVENT,
+      rollupCategory: RollupCategory.Alerts,
+    });
+    getSetting(STATE_CHANGED_EVENT)["alertByEmail"] = false;
+
+    const stats: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+      now: NOW,
+    });
+
+    expect(stats.sent).toBe(1);
+    expect(harness.sent).toHaveLength(1);
+    const mail: SentRollupMail = harness.sent[0]!;
+    expect(mail.subject).toBe("[Acme] 2 notifications: 1 Alerts, 1 Incidents");
+    expect(mail.vars["summaryCount"]).toBe("2 notifications");
+    expect(JSON.stringify(mail.vars)).toContain("Checkout is down");
+    expect(JSON.stringify(mail.vars)).toContain("CPU is high");
+    expect(JSON.stringify(mail.vars)).not.toContain(
+      "Muted incident state change",
+    );
+    expect(harness.batches[0]!.itemCount).toBe(2);
+    expect(pendingItems(harness)).toHaveLength(0);
+    expect(harness.items).toHaveLength(3);
+    expect(harness.callLog).toEqual(["preferences", "stamp", "send"]);
+  });
+
+  test.each([false, null, undefined])(
+    "an event whose email preference is %s is skipped even if other channels remain enabled",
+    async (alertByEmail: boolean | null | undefined) => {
+      seedDue();
+      const setting: FakeRow = getSetting(CREATED_EVENT);
+      setting["alertByEmail"] = alertByEmail;
+      setting["alertByPush"] = true;
+      setting["alertBySMS"] = true;
+
+      const stats: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+        now: NOW,
+      });
+
+      expect(stats.skipped).toBe(1);
+      expect(stats.sent).toBe(0);
+      expect(harness.sendAttempts).toHaveLength(0);
+      expect(harness.batches[0]!.status).toBe(RollupBatchStatus.Skipped);
+      expect(harness.batches[0]!.itemCount).toBe(0);
+      expect(harness.batches[0]!.sentAt).toBeNull();
+      expect(harness.batches[0]!.statusMessage).toContain("no longer enabled");
+      expect(pendingItems(harness)).toHaveLength(0);
+      expect(setting["alertByPush"]).toBe(true);
+      expect(setting["alertBySMS"]).toBe(true);
+    },
+  );
+
+  test("deleting a preference removes that event from an otherwise enabled batch", async () => {
+    seedDue({ subject: "Deleted subscription" });
+    seedDue({
+      subject: "Still subscribed",
+      eventType: STATE_CHANGED_EVENT,
+    });
+    harness.notificationSettings = harness.notificationSettings.filter(
+      (row: FakeRow): boolean => {
+        return row["eventType"] !== CREATED_EVENT;
+      },
+    );
+
+    await EmailRollupFlushRunner.runSweep({ now: NOW });
+
+    expect(harness.sent).toHaveLength(1);
+    expect(harness.sent[0]!.subject).toContain("Still subscribed");
+    expect(JSON.stringify(harness.sent[0]!.vars)).not.toContain(
+      "Deleted subscription",
+    );
+    expect(harness.batches[0]!.itemCount).toBe(1);
+  });
+
+  test("an absent preference is not replaced by another user's or project's enabled preference", async () => {
+    seedDue();
+    harness.notificationSettings = [];
+    seedNotificationSetting(harness, {
+      projectId: OTHER_PROJECT_ID,
+      userId: USER_ID,
+      eventType: CREATED_EVENT,
+    });
+    seedNotificationSetting(harness, {
+      projectId: PROJECT_ID,
+      userId: OTHER_USER_ID,
+      eventType: CREATED_EVENT,
+    });
+
+    const stats: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+      now: NOW,
+    });
+
+    expect(stats.skipped).toBe(1);
+    expect(harness.sendAttempts).toHaveLength(0);
+    expect(UserNotificationSettingService.findBy).toHaveBeenCalledWith({
+      query: {
+        projectId: PROJECT_ID,
+        userId: USER_ID,
+        alertByEmail: true,
+      },
+      select: { eventType: true },
+      limit: expect.any(Number),
+      skip: 0,
+      props: { isRoot: true },
+    });
+  });
+
+  test("muting one recipient leaves other users and other projects subscribed", async () => {
+    seedProject(harness, { projectId: OTHER_PROJECT_ID, name: "Beta" });
+    seedVerifiedEmail(harness, {
+      projectId: OTHER_PROJECT_ID,
+      userId: USER_ID,
+      email: TO_EMAIL,
+    });
+    seedVerifiedEmail(harness, {
+      projectId: PROJECT_ID,
+      userId: OTHER_USER_ID,
+      email: OTHER_EMAIL,
+    });
+    seedDue({ subject: "Muted in Acme" });
+    seedDue({ subject: "Enabled in Beta", projectId: OTHER_PROJECT_ID });
+    seedDue({
+      subject: "Enabled for another user",
+      userId: OTHER_USER_ID,
+      toEmail: OTHER_EMAIL,
+    });
+    getSetting(CREATED_EVENT)["alertByEmail"] = false;
+
+    const stats: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+      now: NOW,
+    });
+
+    expect(stats.skipped).toBe(1);
+    expect(stats.sent).toBe(2);
+    expect(
+      harness.sent.map((mail: SentRollupMail): string => {
+        return mail.subject;
+      }),
+    ).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining("Enabled in Beta"),
+        expect.stringContaining("Enabled for another user"),
+      ]),
+    );
+    expect(JSON.stringify(harness.sent)).not.toContain("Muted in Acme");
+  });
+
+  test("a fully muted batch stays consumed after email is enabled again", async () => {
+    seedDue();
+    getSetting(CREATED_EVENT)["alertByEmail"] = false;
+    await EmailRollupFlushRunner.runSweep({ now: NOW });
+    getSetting(CREATED_EVENT)["alertByEmail"] = true;
+
+    const later: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+      now: OneUptimeDate.addRemoveMinutes(NOW, CLAIM_EPOCH_MINUTES),
+    });
+
+    expect(later.bucketsDue).toBe(0);
+    expect(harness.batches).toHaveLength(1);
+    expect(harness.sendAttempts).toHaveLength(0);
+  });
+
+  test("the most recent preference is used when email is enabled again before the flush", async () => {
+    seedDue();
+    getSetting(CREATED_EVENT)["alertByEmail"] = false;
+    getSetting(CREATED_EVENT)["alertByEmail"] = true;
+
+    await EmailRollupFlushRunner.runSweep({ now: NOW });
+
+    expect(harness.sent).toHaveLength(1);
+    expect(harness.batches[0]!.itemCount).toBe(1);
+  });
+
+  test("a preference lookup failure preserves pending items and retries once in the next epoch", async () => {
+    seedDue({ subject: "Keep for retry" });
+    seedDue({ subject: "Also keep for retry" });
+    jest
+      .spyOn(UserNotificationSettingService, "findBy")
+      .mockRejectedValueOnce(new Error("preferences read timed out"));
+
+    const failed: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+      now: NOW,
+    });
+
+    expect(failed.failed).toBe(1);
+    expect(harness.batches[0]!.status).toBe(RollupBatchStatus.Failed);
+    expect(harness.batches[0]!.itemCount).toBe(0);
+    expect(harness.batches[0]!.statusMessage).toBe(
+      "preferences read timed out",
+    );
+    expect(pendingItems(harness)).toHaveLength(2);
+    expect(
+      harness.items.every((item: FakeItemRow): boolean => {
+        return item.rollupBatchId === null;
+      }),
+    ).toBe(true);
+    expect(harness.itemUpdateByCalls).toBe(0);
+    expect(harness.sendAttempts).toHaveLength(0);
+
+    const sameEpoch: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+      now: NOW,
+    });
+    expect(sameEpoch.claimCollisions).toBe(1);
+    expect(UserNotificationSettingService.findBy).toHaveBeenCalledTimes(1);
+
+    await EmailRollupFlushRunner.runSweep({
+      now: OneUptimeDate.addRemoveMinutes(NOW, CLAIM_EPOCH_MINUTES),
+    });
+
+    expect(harness.batches).toHaveLength(2);
+    expect(harness.batches[1]!.status).toBe(RollupBatchStatus.Sent);
+    expect(harness.batches[1]!.itemCount).toBe(2);
+    expect(harness.sent).toHaveLength(1);
+    expect(pendingItems(harness)).toHaveLength(0);
+  });
+
+  test("a preference lookup failure does not prevent another recipient's delivery", async () => {
+    seedDue();
+    seedVerifiedEmail(harness, {
+      projectId: PROJECT_ID,
+      userId: OTHER_USER_ID,
+      email: OTHER_EMAIL,
+    });
+    seedDue({ userId: OTHER_USER_ID, toEmail: OTHER_EMAIL });
+    jest
+      .spyOn(UserNotificationSettingService, "findBy")
+      .mockRejectedValueOnce(new Error("preferences read timed out"));
+
+    const stats: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+      now: NOW,
+    });
+
+    expect(stats.failed).toBe(1);
+    expect(stats.sent).toBe(1);
+    expect(harness.sent[0]!.toEmail).toBe(OTHER_EMAIL.toString());
+    expect(pendingItems(harness)).toHaveLength(1);
+    expect(pendingItems(harness)[0]!.userId).toBe(USER_ID);
+  });
+
+  test("a failed send records only the enabled items that were attempted", async () => {
+    seedDue();
+    seedDue({ eventType: STATE_CHANGED_EVENT });
+    getSetting(STATE_CHANGED_EVENT)["alertByEmail"] = false;
+    harness.failSend = (): Error => {
+      return new Error("mail transport unavailable");
+    };
+
+    const stats: RollupSweepStats = await EmailRollupFlushRunner.runSweep({
+      now: NOW,
+    });
+
+    expect(stats.failed).toBe(1);
+    expect(harness.batches[0]!.status).toBe(RollupBatchStatus.Failed);
+    expect(harness.batches[0]!.itemCount).toBe(1);
+    expect(harness.sendAttempts[0]!.vars["summaryCount"]).toBe(
+      "1 notification",
+    );
+    expect(pendingItems(harness)).toHaveLength(0);
+  });
+});

package/Tests/Server/Utils/EmailRollup/EmailRollupTestHarness.ts

@@ -7,6 +7,7 @@ import ProjectService from "../../../../Server/Services/ProjectService";
 import UserEmailService from "../../../../Server/Services/UserEmailService";
 import UserNotificationEmailRollupBatchService from "../../../../Server/Services/UserNotificationEmailRollupBatchService";
 import UserNotificationEmailRollupItemService from "../../../../Server/Services/UserNotificationEmailRollupItemService";
+import UserNotificationSettingService from "../../../../Server/Services/UserNotificationSettingService";
 import logger from "../../../../Server/Utils/Logger";
 import UserNotificationEmailRollupBatch, {
   RollupBatchStatus,
@@ -102,6 +103,8 @@ export interface RollupHarness {
   batches: Array<FakeBatchRow>;
   // UserEmail rows: { _id, id, userId, projectId, isVerified, email }.
   userEmails: Array<FakeRow>;
+  // Current event preferences; queued events start enabled at enqueue time.
+  notificationSettings: Array<FakeRow>;
   // Project rows: { _id, id, name }.
   projects: Array<FakeRow>;
 
@@ -114,7 +117,8 @@ export interface RollupHarness {
 
   /*
    * An ordered trace of the collaborator calls whose ORDER is load-bearing.
-   * "stamp" is pushed by the item updateBy, "send" by MailService.sendMail:
+   * "preferences" is pushed by the settings read, "stamp" by the item
+   * updateBy, and "send" by MailService.sendMail:
    * stamp-before-send is the property that stops a permanently failing send
    * re-spamming an address every epoch, and it is only observable as an
    * ordering.
@@ -165,6 +169,7 @@ export function emptyRollupHarness(): RollupHarness {
     items: [],
     batches: [],
     userEmails: [],
+    notificationSettings: [],
     projects: [],
     sendAttempts: [],
     sent: [],
@@ -367,9 +372,55 @@ export function seedItem(
 
   harness.items.push(row);
 
+  /*
+   * An owner email only enters the queue when its event is enabled. Seed that
+   * initial preference once; tests can then disable or remove it before the
+   * flush to exercise changes made while the email was waiting.
+   */
+  const hasSetting: boolean = harness.notificationSettings.some(
+    (setting: FakeRow): boolean => {
+      return (
+        toKey(setting["projectId"]) === toKey(row.projectId) &&
+        toKey(setting["userId"]) === toKey(row.userId) &&
+        setting["eventType"] === row.eventType
+      );
+    },
+  );
+
+  if (!hasSetting) {
+    seedNotificationSetting(harness, {
+      projectId: row.projectId,
+      userId: row.userId,
+      eventType: row.eventType,
+    });
+  }
+
   return row;
 }
 
+export function seedNotificationSetting(
+  harness: RollupHarness,
+  data: {
+    projectId: ObjectID;
+    userId: ObjectID;
+    eventType: NotificationSettingEventType;
+    alertByEmail?: boolean | undefined;
+  },
+): FakeRow {
+  const id: ObjectID = ObjectID.generate();
+  const setting: FakeRow = {
+    _id: id,
+    id: id,
+    projectId: data.projectId,
+    userId: data.userId,
+    eventType: data.eventType,
+    alertByEmail: data.alertByEmail ?? true,
+  };
+
+  harness.notificationSettings.push(setting);
+  return setting;
+}
+
 export function seedVerifiedEmail(
   harness: RollupHarness,
   data: {
@@ -649,6 +700,31 @@ export function installRollupHarness(harness: RollupHarness): void {
 
   // -- The recipient re-validation ----------------------------------------
 
+  jest
+    .spyOn(UserNotificationSettingService, "findBy")
+    .mockImplementation(((args: {
+      query?: Record<string, unknown>;
+      select?: Record<string, unknown>;
+      limit?: unknown;
+      skip?: number;
+    }) => {
+      harness.callLog.push("preferences");
+      const matched: Array<FakeRow> = harness.notificationSettings.filter(
+        (row: FakeRow): boolean => {
+          return matchesQuery(args.query, row);
+        },
+      );
+      const skip: number = args.skip ?? 0;
+
+      return Promise.resolve(
+        matched
+          .slice(skip, skip + toLimit(args.limit, matched.length))
+          .map((row: FakeRow): FakeRow => {
+            return applySelect(row, args.select);
+          }),
+      );
+    }) as never);
+
   jest.spyOn(UserEmailService, "findBy").mockImplementation(((args: {
     query?: Record<string, unknown>;
     select?: Record<string, unknown>;

package/Tests/Server/Utils/FrontendEnvironment.test.ts

@@ -0,0 +1,190 @@
+import { afterEach, describe, expect, test, jest } from "@jest/globals";
+import type {
+  ExpressRequest,
+  ExpressResponse,
+} from "../../../Server/Utils/Express";
+
+const MANAGED_KEYS: Array<string> = [
+  "HOST",
+  "PUBLIC_TEST_SETTING",
+  "OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+  "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY",
+  "PUBLIC_OTEL_EXPORTER_OTLP_HEADERS",
+];
+
+const originalEnv: NodeJS.ProcessEnv = { ...process.env };
+
+interface BrowserWindow {
+  process?: {
+    env?: Record<string, unknown>;
+  };
+}
+
+async function render(
+  overrides: Record<string, string | undefined>,
+  initialWindow: BrowserWindow = {},
+): Promise<{ script: string; window: BrowserWindow }> {
+  for (const key of MANAGED_KEYS) {
+    delete process.env[key];
+  }
+
+  for (const [key, value] of Object.entries(overrides)) {
+    if (typeof value === "undefined") {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+
+  jest.resetModules();
+  const { getFrontendEnvironmentScript } = await import(
+    "../../../Server/Utils/FrontendEnvironment"
+  );
+  const script: string = getFrontendEnvironmentScript();
+
+  new Function("window", script)(initialWindow);
+
+  return { script, window: initialWindow };
+}
+
+afterEach(() => {
+  process.env = { ...originalEnv };
+  jest.resetModules();
+});
+
+describe("frontend environment script serialization", () => {
+  test("creates window.process and window.process.env when neither exists", async () => {
+    const result: Awaited<ReturnType<typeof render>> = await render({
+      HOST: "oneuptime.example.com",
+    });
+
+    expect(result.window.process?.env).toMatchObject({
+      HOST: "oneuptime.example.com",
+    });
+  });
+
+  test("replaces a stale pre-existing environment snapshot", async () => {
+    const initialWindow: BrowserWindow = {
+      process: { env: { STALE_SECRET: "must-disappear" } },
+    };
+    const result: Awaited<ReturnType<typeof render>> = await render(
+      { HOST: "fresh.example.com" },
+      initialWindow,
+    );
+
+    expect(result.window.process?.env).toMatchObject({
+      HOST: "fresh.example.com",
+    });
+    expect(result.window.process?.env).not.toHaveProperty("STALE_SECRET");
+  });
+
+  test("does not reflect a backend bearer token in either script bytes or runtime values", async () => {
+    const sentinel: string =
+      'super-secret-\\"token\\nwith-special-characters-and-123456';
+    const result: Awaited<ReturnType<typeof render>> = await render({
+      OPENTELEMETRY_EXPORTER_OTLP_HEADERS: `authorization=Bearer ${sentinel}`,
+    });
+
+    expect(result.script).not.toContain("authorization");
+    expect(result.script).not.toContain("super-secret");
+    expect(JSON.stringify(result.window.process?.env)).not.toContain(
+      "super-secret",
+    );
+  });
+
+  test("does not reflect a backend endpoint that may contain URL credentials", async () => {
+    const result: Awaited<ReturnType<typeof render>> = await render({
+      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT:
+        "https://server-user:server-password@collector.internal:4318",
+    });
+
+    expect(result.script).not.toContain("server-user");
+    expect(result.script).not.toContain("server-password");
+  });
+
+  test("does not serialize a PUBLIC_-prefixed standard OTLP header alias", async () => {
+    const result: Awaited<ReturnType<typeof render>> = await render({
+      PUBLIC_OTEL_EXPORTER_OTLP_HEADERS:
+        "authorization=Bearer public-alias-secret",
+    });
+
+    expect(result.script).not.toContain("public-alias-secret");
+    expect(result.window.process?.env).not.toHaveProperty(
+      "PUBLIC_OTEL_EXPORTER_OTLP_HEADERS",
+    );
+  });
+
+  test("serializes the public browser endpoint and origin-bound Browser key", async () => {
+    const result: Awaited<ReturnType<typeof render>> = await render({
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT:
+        "https://ingest.example.com:4318",
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY:
+        "public-browser-key",
+    });
+
+    expect(result.window.process?.env).toMatchObject({
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT:
+        "https://ingest.example.com:4318",
+      PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY:
+        "public-browser-key",
+    });
+  });
+
+  test("serializes hostile-looking public text as data without breaking the script", async () => {
+    const unusualPublicValue: string = '</script>";window.pwned=true;//';
+    const result: Awaited<ReturnType<typeof render>> = await render({
+      PUBLIC_TEST_SETTING: unusualPublicValue,
+    });
+
+    expect(result.window.process?.env?.["PUBLIC_TEST_SETTING"]).toBe(
+      unusualPublicValue,
+    );
+    expect((result.window as BrowserWindow & { pwned?: boolean }).pwned).toBe(
+      undefined,
+    );
+  });
+
+  test("emits a valid empty telemetry configuration when all telemetry values are unset", async () => {
+    const result: Awaited<ReturnType<typeof render>> = await render({});
+
+    expect(result.window.process?.env).not.toHaveProperty(
+      "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+    );
+    expect(result.window.process?.env).not.toHaveProperty(
+      "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY",
+    );
+  });
+
+  test("marks the complete environment response private and non-cacheable", async () => {
+    jest.resetModules();
+    const {
+      FRONTEND_ENVIRONMENT_CACHE_CONTROL,
+      sendFrontendEnvironmentResponse,
+    } = await import("../../../Server/Utils/FrontendEnvironment");
+    const setHeader: ReturnType<typeof jest.fn> = jest.fn();
+    const writeHead: ReturnType<typeof jest.fn> = jest.fn();
+    const end: ReturnType<typeof jest.fn> = jest.fn();
+    const response: ExpressResponse = {
+      setHeader,
+      writeHead,
+      end,
+    } as unknown as ExpressResponse;
+
+    sendFrontendEnvironmentResponse({} as unknown as ExpressRequest, response);
+
+    expect(setHeader).toHaveBeenCalledWith(
+      "Cache-Control",
+      FRONTEND_ENVIRONMENT_CACHE_CONTROL,
+    );
+    expect(FRONTEND_ENVIRONMENT_CACHE_CONTROL).toContain("private");
+    expect(FRONTEND_ENVIRONMENT_CACHE_CONTROL).toContain("no-store");
+    expect(setHeader).toHaveBeenCalledWith("Pragma", "no-cache");
+    expect(setHeader).toHaveBeenCalledWith("Expires", "0");
+    expect(writeHead).toHaveBeenCalledWith(200, {
+      "Content-Type": "text/javascript",
+    });
+    expect(end).toHaveBeenCalledTimes(1);
+  });
+});