@oneuptime/common 12.0.34 → 13.0.1

package/Tests/Server/Services/DatabaseServiceSortTiebreaker.test.ts

@@ -0,0 +1,151 @@
+import DatabaseService from "../../../Server/Services/DatabaseService";
+import InventoryItem from "../../../Models/DatabaseModels/InventoryItem";
+import SortOrder from "../../../Types/BaseDatabase/SortOrder";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+
+/*
+ * Every paged read here is LIMIT/OFFSET, and OFFSET only means anything
+ * against an ordering with no ties. Rows that compare equal may come back in
+ * any order, and nothing obliges Postgres to pick the same order for the query
+ * that fetches page 1 and the query that fetches page 2 — so a tied row can be
+ * served on both pages while another is served on neither. The user sees one
+ * item listed twice.
+ *
+ * The Inventory list is where this bites hardest, and it is why it belongs in
+ * the duplicate-items fix: it sorts on `lastSeenAt`, which the entity
+ * reconciler rewrites for every live entity every few minutes, so the sort key
+ * is being mutated between the two fetches by design rather than by bad luck.
+ * The inventory mirror also stamps one identical `lastSeenAt` across a whole
+ * page of rows at a time, which produces large exact-tie groups outright.
+ *
+ * The fix is to complete whatever sort the caller asked for into a total order
+ * by appending the primary key, in the one place every paged read goes
+ * through.
+ */
+
+type FindArgs = {
+  order?: Record<string, unknown> | undefined;
+  select?: Record<string, unknown> | undefined;
+};
+
+describe("DatabaseService._findBy completes a partial sort into a total order", () => {
+  let service: DatabaseService<InventoryItem>;
+  let find: jest.Mock;
+
+  type FindByFunction = (
+    sort?: Record<string, unknown> | undefined,
+  ) => Promise<Array<InventoryItem>>;
+
+  const findBy: FindByFunction = (
+    sort?: Record<string, unknown> | undefined,
+  ): Promise<Array<InventoryItem>> => {
+    return service.findBy({
+      query: {},
+      limit: 10,
+      skip: 0,
+      select: { displayName: true } as any,
+      ...(sort ? { sort: sort as any } : {}),
+      props: { isRoot: true },
+    });
+  };
+
+  const orderPassedToDatabase: () => Record<string, unknown> = (): Record<
+    string,
+    unknown
+  > => {
+    return (find.mock.calls[0]![0] as FindArgs).order || {};
+  };
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+
+    service = new DatabaseService<InventoryItem>(InventoryItem);
+
+    find = jest
+      .fn()
+      .mockImplementation(async (): Promise<Array<InventoryItem>> => {
+        return [];
+      });
+
+    jest.spyOn(service, "getRepository").mockReturnValue({ find: find } as any);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("appends the primary key to a single-column sort", async () => {
+    await findBy({ lastSeenAt: SortOrder.Descending });
+
+    expect(orderPassedToDatabase()).toEqual({
+      lastSeenAt: SortOrder.Descending,
+      _id: SortOrder.Ascending,
+    });
+  });
+
+  it("keeps the caller's column first so the requested ordering is unchanged", async () => {
+    await findBy({ lastSeenAt: SortOrder.Descending });
+
+    expect(Object.keys(orderPassedToDatabase())).toEqual(["lastSeenAt", "_id"]);
+  });
+
+  it("appends the primary key to a multi-column sort", async () => {
+    await findBy({
+      entityType: SortOrder.Ascending,
+      lastSeenAt: SortOrder.Descending,
+    });
+
+    expect(Object.keys(orderPassedToDatabase())).toEqual([
+      "entityType",
+      "lastSeenAt",
+      "_id",
+    ]);
+  });
+
+  it("appends the primary key to the default sort as well", async () => {
+    await findBy(undefined);
+
+    expect(orderPassedToDatabase()).toEqual({
+      createdAt: SortOrder.Descending,
+      _id: SortOrder.Ascending,
+    });
+  });
+
+  it("leaves an explicit primary-key sort alone", async () => {
+    await findBy({ _id: SortOrder.Descending });
+
+    expect(orderPassedToDatabase()).toEqual({ _id: SortOrder.Descending });
+  });
+
+  it("does not add the primary key twice when it is already the tiebreaker", async () => {
+    await findBy({
+      lastSeenAt: SortOrder.Descending,
+      _id: SortOrder.Descending,
+    });
+
+    expect(orderPassedToDatabase()).toEqual({
+      lastSeenAt: SortOrder.Descending,
+      _id: SortOrder.Descending,
+    });
+  });
+
+  it("does not widen the projection — the primary key is already selected", async () => {
+    await findBy({ lastSeenAt: SortOrder.Descending });
+
+    const select: Record<string, unknown> = (find.mock.calls[0]![0] as FindArgs)
+      .select as Record<string, unknown>;
+
+    expect(select["_id"]).toBe(true);
+    expect(select["displayName"]).toBe(true);
+  });
+
+  it("does not mutate the caller's own sort object", async () => {
+    const callerSort: Record<string, unknown> = {
+      lastSeenAt: SortOrder.Descending,
+    };
+
+    await findBy(callerSort);
+
+    expect(callerSort).toEqual({ lastSeenAt: SortOrder.Descending });
+  });
+});

package/Tests/Server/Services/DiscoveryScanClaimHookFreeSafety.test.ts

@@ -3,6 +3,7 @@ import NetworkDeviceDiscoveryScanService, {
 } from "../../../Server/Services/NetworkDeviceDiscoveryScanService";
 import DatabaseService from "../../../Server/Services/DatabaseService";
 import NetworkDeviceDiscoveryScan from "../../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+import { DISCOVERY_SCAN_STARTED_MESSAGE } from "../../../Utils/NetworkDiscovery/DiscoveryScanStatus";
 import {
   afterEach,
   beforeEach,
@@ -15,7 +16,7 @@ import {
 /*
  * The /probe-ingest/probe/discovery-scan/list route hands the requesting
  * probe its pending subnet scans and claims them (status "In Progress" +
- * startedAt, and a cleared statusMessage) via
+ * startedAt, and a current-run statusMessage) via
  * DatabaseService.updateColumnsByIdWithoutHooks — one raw
  * parameterized UPDATE that skips ALL on-update hooks: workflow HTTP
  * triggers, audit-log inserts, realtime events, service
@@ -74,6 +75,17 @@ const PROGRESS_WRITE_COLUMNS: Array<string> = [
   "autoImportProcessedAt",
 ];
 
+/*
+ * The stale-scan reaper also writes atomically so a new progress report cannot
+ * race with its decision to fail a silent run. It skips the same service hooks.
+ */
+const REAPER_WRITE_COLUMNS: Array<string> = [
+  "status",
+  "statusMessage",
+  "completedAt",
+  "nextScanAt",
+];
+
 describe("discovery-scan claim hookless write safety preconditions", () => {
   describe("NetworkDeviceDiscoveryScan model (claim write in DiscoveryScan.ts)", () => {
     /*
@@ -115,6 +127,7 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
         "statusMessage",
         // ...and every column the running-sweep progress write stamps.
         ...PROGRESS_WRITE_COLUMNS,
+        ...REAPER_WRITE_COLUMNS,
       ];
       for (const column of fastPathColumns) {
         expect(scan.isTableColumn(column)).toBe(true);
@@ -219,6 +232,7 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
          * skipping it.
          */
         ...PROGRESS_WRITE_COLUMNS,
+        ...REAPER_WRITE_COLUMNS,
       ];
 
       for (const column of claimWriteColumns) {
@@ -324,7 +338,7 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
         data: {
           status: "In Progress",
           startedAt: new Date(0),
-          statusMessage: null,
+          statusMessage: DISCOVERY_SCAN_STARTED_MESSAGE,
         },
         props: { isRoot: true },
         limit: 1,

package/Tests/Server/Services/GoogleSecOpsDiagnosticsModel.test.ts

@@ -0,0 +1,153 @@
+import GoogleSecOpsConnection from "../../../Models/DatabaseModels/GoogleSecOpsConnection";
+import GoogleSecOpsConnectionRun from "../../../Models/DatabaseModels/GoogleSecOpsConnectionRun";
+import GoogleSecOpsConnectionService from "../../../Server/Services/GoogleSecOpsConnectionService";
+import GoogleSecOpsClient from "../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient";
+import Permission from "../../../Types/Permission";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+interface ConnectionHooks {
+  onBeforeCreate: (data: unknown) => Promise<unknown>;
+  onBeforeUpdate: (data: unknown) => Promise<unknown>;
+}
+
+const hooks: ConnectionHooks =
+  GoogleSecOpsConnectionService as unknown as ConnectionHooks;
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("Google SecOps diagnostics access boundaries", () => {
+  test("run history is tenant scoped and cannot be created, changed or deleted through CRUD", () => {
+    const run: GoogleSecOpsConnectionRun = new GoogleSecOpsConnectionRun();
+    expect(run.getTenantColumn()).toBe("projectId");
+    expect(run.getCrudApiPath()?.toString()).toBe(
+      "/google-secops-connection-run",
+    );
+    expect(run.createRecordPermissions).toEqual([]);
+    expect(run.updateRecordPermissions).toEqual([]);
+    expect(run.deleteRecordPermissions).toEqual([]);
+    expect(run.readRecordPermissions).toEqual([
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
+    ]);
+    expect(run.readRecordPermissions).not.toContain(Permission.Public);
+  });
+
+  test.each([
+    "projectId",
+    "googleSecOpsConnectionId",
+    "requestedByUserId",
+    "type",
+    "status",
+    "request",
+    "result",
+    "error",
+    "startedAt",
+    "completedAt",
+  ])(
+    "run field %s is readable by security viewers and writable only internally",
+    (field: string) => {
+      const control: ReturnType<
+        GoogleSecOpsConnection["getColumnAccessControlFor"]
+      > = new GoogleSecOpsConnectionRun().getColumnAccessControlFor(field);
+      expect(control?.create).toEqual([]);
+      expect(control?.update).toEqual([]);
+      expect(control?.read).toContain(Permission.SecurityViewer);
+    },
+  );
+
+  test.each(["lastSuccessfulPollAt", "lastEventIngestedAt", "lastPollResult"])(
+    "clients cannot forge the connection's %s",
+    (field: string) => {
+      const control: ReturnType<
+        GoogleSecOpsConnection["getColumnAccessControlFor"]
+      > = new GoogleSecOpsConnection().getColumnAccessControlFor(field);
+      expect(control?.create).toEqual([]);
+      expect(control?.update).toEqual([]);
+      expect(control?.read).toContain(Permission.SecurityMember);
+    },
+  );
+
+  test("only connector administrators can change the detection scope", () => {
+    const control: ReturnType<
+      GoogleSecOpsConnection["getColumnAccessControlFor"]
+    > = new GoogleSecOpsConnection().getColumnAccessControlFor(
+      "includeNonAlertingDetections",
+    );
+    expect(control?.update).toEqual([
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SecurityAdmin,
+    ]);
+    expect(control?.create).toEqual(control?.update);
+    expect(control?.read).toContain(Permission.SecurityViewer);
+  });
+
+  test("diagnostics do not make the service account readable or add it to run history", () => {
+    const connection: GoogleSecOpsConnection = new GoogleSecOpsConnection();
+    expect(
+      connection.getColumnAccessControlFor("serviceAccountJson")?.read,
+    ).toEqual([]);
+    expect(Object.keys(new GoogleSecOpsConnectionRun())).not.toContain(
+      "serviceAccountJson",
+    );
+  });
+});
+
+describe("Google SecOps detection scope validation", () => {
+  test.each([true, false, undefined])(
+    "accepts scope %s on update",
+    async (value: boolean | undefined) => {
+      await expect(
+        hooks.onBeforeUpdate({ data: { includeNonAlertingDetections: value } }),
+      ).resolves.toBeDefined();
+    },
+  );
+
+  test.each([null, "true", "false", "", 0, 1, [], {}])(
+    "rejects non-boolean scope %p on update",
+    async (value: unknown) => {
+      await expect(
+        hooks.onBeforeUpdate({ data: { includeNonAlertingDetections: value } }),
+      ).rejects.toThrow("must be true or false");
+    },
+  );
+
+  test.each([true, false])(
+    "accepts scope %s when creating a connection",
+    async (value: boolean) => {
+      jest
+        .spyOn(GoogleSecOpsClient, "parseServiceAccountJson")
+        .mockReturnValue({
+          clientEmail: "test@example.com",
+          privateKey: "test",
+          tokenUri: "https://oauth2.googleapis.com/token",
+        });
+      await expect(
+        hooks.onBeforeCreate({
+          data: {
+            serviceAccountJson: "{}",
+            includeNonAlertingDetections: value,
+          },
+        }),
+      ).resolves.toBeDefined();
+    },
+  );
+
+  test("rejects invalid scope on create before processing credentials", async () => {
+    jest.spyOn(GoogleSecOpsClient, "parseServiceAccountJson");
+    await expect(
+      hooks.onBeforeCreate({
+        data: {
+          serviceAccountJson: "{}",
+          includeNonAlertingDetections: "false",
+        },
+      }),
+    ).rejects.toThrow("must be true or false");
+    expect(GoogleSecOpsClient.parseServiceAccountJson).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Services/HookFreeWriteLengthClamp.test.ts

@@ -8,6 +8,7 @@ import IoTFleetService from "../../../Server/Services/IoTFleetService";
 import KubernetesClusterService from "../../../Server/Services/KubernetesClusterService";
 import PodmanHostService from "../../../Server/Services/PodmanHostService";
 import ProxmoxClusterService from "../../../Server/Services/ProxmoxClusterService";
+import VMwareVCenterService from "../../../Server/Services/VMwareVCenterService";
 import RumApplicationService from "../../../Server/Services/RumApplicationService";
 import ServerlessFunctionService from "../../../Server/Services/ServerlessFunctionService";
 import CephCluster from "../../../Models/DatabaseModels/CephCluster";
@@ -20,6 +21,7 @@ import IoTFleet from "../../../Models/DatabaseModels/IoTFleet";
 import KubernetesCluster from "../../../Models/DatabaseModels/KubernetesCluster";
 import PodmanHost from "../../../Models/DatabaseModels/PodmanHost";
 import ProxmoxCluster from "../../../Models/DatabaseModels/ProxmoxCluster";
+import VMwareVCenter from "../../../Models/DatabaseModels/VMwareVCenter";
 import RumApplication from "../../../Models/DatabaseModels/RumApplication";
 import ServerlessFunction from "../../../Models/DatabaseModels/ServerlessFunction";
 import LogDropFilter from "../../../Models/DatabaseModels/LogDropFilter";
@@ -200,6 +202,17 @@ const CLAMP_CASES: Array<ClampCase> = [
     model: new ProxmoxCluster(),
     columns: ["pveVersion", "agentVersion"],
   },
+  {
+    /*
+     * The vcenter receiver does not report the vSphere version, so
+     * agentVersion is the only collector-supplied string this heartbeat
+     * can write.
+     */
+    name: "VMwareVCenterService",
+    service: VMwareVCenterService,
+    model: new VMwareVCenter(),
+    columns: ["agentVersion"],
+  },
   {
     name: "IoTFleetService",
     service: IoTFleetService,

package/Tests/Server/Services/InventoryItemManualCreate.test.ts

@@ -246,3 +246,108 @@ describe("machine creates are left alone", () => {
     expect(createBy.data.source).toBe(EntitySource.Inventory);
   });
 });
+
+/*
+ * The escape hatch above is for the two machine writers, which reach the
+ * service directly with `props: { isRoot: true }`. It used to be keyed on the
+ * PAYLOAD instead — "did the caller send an entityKey" — which let anyone
+ * posting to the public CRUD endpoint skip every check in the hook simply by
+ * inventing one, and claim a source only ingest is supposed to write. A row
+ * that says `discovered` is a row the prune sweep is entitled to delete on a
+ * TTL, so this was not only a lie in the Source column.
+ */
+describe("non-root creates cannot impersonate a machine writer", () => {
+  function apiCreate(data: InventoryItem): CreateBy<InventoryItem> {
+    return { data, props: {} } as CreateBy<InventoryItem>;
+  }
+
+  function externalService(): InventoryItem {
+    const data: InventoryItem = new InventoryItem();
+    data.projectId = PROJECT_ID;
+    data.entityType = EntityType.ExternalService;
+    data.displayName = "Stripe Payments API";
+    return data;
+  }
+
+  test("a client-supplied entity key is discarded and the key re-derived", async () => {
+    const data: InventoryItem = externalService();
+    data.entityKey = "deadbeefdeadbeef";
+
+    const createBy: CreateBy<InventoryItem> = apiCreate(data);
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.entityKey).toBe(
+      keyForManualEntity(
+        PROJECT_ID.toString(),
+        EntityType.ExternalService,
+        "Stripe Payments API",
+      ),
+    );
+    expect(createBy.data.source).toBe(EntitySource.Manual);
+  });
+
+  test("a client-supplied source of discovered is overridden to manual", async () => {
+    const data: InventoryItem = externalService();
+    data.entityKey = "deadbeefdeadbeef";
+    data.source = EntitySource.Discovered;
+
+    const createBy: CreateBy<InventoryItem> = apiCreate(data);
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.source).toBe(EntitySource.Manual);
+  });
+
+  test("a client-supplied source of inventory is overridden to manual", async () => {
+    const data: InventoryItem = externalService();
+    data.entityKey = "deadbeefdeadbeef";
+    data.source = EntitySource.Inventory;
+
+    const createBy: CreateBy<InventoryItem> = apiCreate(data);
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.source).toBe(EntitySource.Manual);
+  });
+
+  test.each([
+    EntityType.Service,
+    EntityType.Host,
+    EntityType.KubernetesPod,
+    EntityType.KubernetesNode,
+    EntityType.NetworkDevice,
+  ])(
+    "the manual-type restriction still applies to %s when a key is supplied",
+    async (entityType: EntityType) => {
+      const data: InventoryItem = externalService();
+      data.entityType = entityType;
+      data.entityKey = "deadbeefdeadbeef";
+      data.source = EntitySource.Discovered;
+
+      await expect(callOnBeforeCreate(apiCreate(data))).rejects.toThrow(
+        /discovered automatically and cannot be created manually/,
+      );
+    },
+  );
+
+  test("the display-name requirement still applies when a key is supplied", async () => {
+    const data: InventoryItem = externalService();
+    data.displayName = "   ";
+    data.entityKey = "deadbeefdeadbeef";
+    data.source = EntitySource.Discovered;
+
+    await expect(callOnBeforeCreate(apiCreate(data))).rejects.toThrow(
+      /Name is required/,
+    );
+  });
+
+  test("firstSeenAt and lastSeenAt are stamped rather than left to the caller", async () => {
+    const data: InventoryItem = externalService();
+    data.entityKey = "deadbeefdeadbeef";
+    data.source = EntitySource.Discovered;
+
+    const createBy: CreateBy<InventoryItem> = apiCreate(data);
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.firstSeenAt).toBeInstanceOf(Date);
+    expect(createBy.data.lastSeenAt).toBeInstanceOf(Date);
+  });
+});

package/Tests/Server/Services/InventoryItemPromotionGate.test.ts

@@ -0,0 +1,183 @@
+import GlobalCache from "../../../Server/Infrastructure/GlobalCache";
+import InventoryItem from "../../../Models/DatabaseModels/InventoryItem";
+import InventoryItemService from "../../../Server/Services/InventoryItemService";
+import Service from "../../../Models/DatabaseModels/Service";
+import ServiceService from "../../../Server/Services/ServiceService";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import EntitySource from "../../../Types/Telemetry/EntitySource";
+import EntityType from "../../../Types/Telemetry/EntityType";
+import { ExtractedEntity } from "../../../Server/Utils/Telemetry/TelemetryEntity";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * What may become a row in the Inventory registry.
+ *
+ * Two gates decide it, and they answer different questions. The TYPE gate asks
+ * whether this kind of thing belongs in the registry at all — containers,
+ * processes, service instances and SDKs are high-churn, so their keys travel on
+ * signals but never mint rows. The per-entity `membershipOnly` flag asks
+ * whether this particular observation is the resource's entity of that type or
+ * a duplicate the producer sent alongside it: one OTLP resource describes one
+ * pod, on one node, in one cluster, but nothing stops a producer emitting two
+ * `entity_refs` of the same type, and promoting both put two rows in Inventory
+ * from a single batch.
+ *
+ * `reconcileEntities` is public, so it repeats both gates rather than trusting
+ * its caller — the cost of a missed gate here is a row that should never have
+ * existed, and once created nothing removes it until its TTL expires.
+ *
+ * Everything external is mocked — no Postgres, no Redis.
+ */
+
+const PROJECT_ID: ObjectID = ObjectID.generate();
+const SERVICE_ROW_ID: ObjectID = ObjectID.generate();
+
+let createdRows: Array<InventoryItem>;
+let bumps: Array<ObjectID>;
+
+function entity(
+  entityType: EntityType,
+  overrides: Partial<ExtractedEntity> = {},
+): ExtractedEntity {
+  return {
+    entityType,
+    entityKey: "0123456789abcdef",
+    identifyingAttributes: { "some.name": "thing" },
+    ...overrides,
+  };
+}
+
+function reconcile(entities: Array<ExtractedEntity>): Promise<void> {
+  return InventoryItemService.reconcileEntities({
+    projectId: PROJECT_ID,
+    entities,
+  });
+}
+
+beforeEach(() => {
+  createdRows = [];
+  bumps = [];
+
+  // Both fences open, so every reconcile actually does its work.
+  jest
+    .spyOn(GlobalCache, "setStringIfNotExists")
+    .mockImplementation(async () => {
+      return true;
+    });
+  jest.spyOn(GlobalCache, "deleteKey").mockImplementation(async () => {
+    return undefined as never;
+  });
+
+  const serviceRow: Service = new Service();
+  serviceRow.id = SERVICE_ROW_ID;
+  serviceRow._id = SERVICE_ROW_ID.toString();
+  jest
+    .spyOn(ServiceService, "findOneBy")
+    .mockImplementation(async (): Promise<Service | null> => {
+      return serviceRow;
+    });
+
+  jest
+    .spyOn(InventoryItemService, "findOneBy")
+    .mockImplementation(async (): Promise<InventoryItem | null> => {
+      return null;
+    });
+
+  jest
+    .spyOn(InventoryItemService, "countBy")
+    .mockImplementation(async (): Promise<PositiveNumber> => {
+      return new PositiveNumber(0);
+    });
+
+  jest
+    .spyOn(InventoryItemService, "create")
+    .mockImplementation(async (createBy: unknown): Promise<InventoryItem> => {
+      const data: InventoryItem = (createBy as { data: InventoryItem }).data;
+      createdRows.push(data);
+      return data;
+    });
+
+  jest
+    .spyOn(InventoryItemService, "updateColumnsByIdIfUnlockedWithoutHooks")
+    .mockImplementation(async (data: unknown): Promise<boolean> => {
+      bumps.push((data as { id: ObjectID }).id);
+      return true;
+    });
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("membership-only entities never become rows", () => {
+  test.each([
+    EntityType.Container,
+    EntityType.Process,
+    EntityType.ServiceInstance,
+    EntityType.TelemetrySdk,
+  ])("%s is not promoted by type", async (entityType: EntityType) => {
+    await reconcile([entity(entityType)]);
+
+    expect(createdRows).toHaveLength(0);
+    expect(bumps).toHaveLength(0);
+  });
+
+  test.each([
+    EntityType.KubernetesPod,
+    EntityType.KubernetesNode,
+    EntityType.Service,
+    EntityType.Host,
+  ])(
+    "%s flagged membershipOnly is not promoted even though its type is",
+    async (entityType: EntityType) => {
+      await reconcile([entity(entityType, { membershipOnly: true })]);
+
+      expect(createdRows).toHaveLength(0);
+      expect(bumps).toHaveLength(0);
+    },
+  );
+
+  test("a demoted duplicate does not suppress the promoted entity beside it", async () => {
+    /*
+     * The shape `entitiesFromRefs` produces when a producer sends two refs of
+     * one type: the first is the entity, the rest are membership keys.
+     */
+    await reconcile([
+      entity(EntityType.KubernetesPod, { entityKey: "aaaaaaaaaaaaaaaa" }),
+      entity(EntityType.KubernetesPod, {
+        entityKey: "bbbbbbbbbbbbbbbb",
+        membershipOnly: true,
+      }),
+    ]);
+
+    expect(createdRows).toHaveLength(1);
+    expect(createdRows[0]!.entityKey).toBe("aaaaaaaaaaaaaaaa");
+  });
+});
+
+describe("promoted entities still become rows", () => {
+  test.each([
+    EntityType.Service,
+    EntityType.Host,
+    EntityType.KubernetesPod,
+    EntityType.KubernetesNode,
+    EntityType.KubernetesCluster,
+    EntityType.KubernetesNamespace,
+    EntityType.KubernetesDeployment,
+    EntityType.ProxmoxCluster,
+    EntityType.CephCluster,
+    EntityType.DockerSwarmCluster,
+    EntityType.VMwareVCenter,
+    EntityType.VMwareCluster,
+    EntityType.VMwareHost,
+    EntityType.VMwareVirtualMachine,
+    EntityType.VMwareDatastore,
+  ])("%s is created as a discovered row", async (entityType: EntityType) => {
+    await reconcile([entity(entityType)]);
+
+    expect(createdRows).toHaveLength(1);
+    expect(createdRows[0]!.source).toBe(EntitySource.Discovered);
+    expect(createdRows[0]!.entityType).toBe(entityType);
+  });
+});