@oneuptime/common 12.0.4 → 12.0.5

package/Tests/Server/API/DashboardMasterPasswordAPI.test.ts

@@ -3,6 +3,7 @@ import DashboardAPI from "../../../Server/API/DashboardAPI";
 import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
 import DashboardService from "../../../Server/Services/DashboardService";
 import CookieUtil from "../../../Server/Utils/Cookie";
+import PasswordHash from "../../../Server/Utils/PasswordHash";
 import {
   ExpressRequest,
   ExpressResponse,
@@ -75,8 +76,12 @@ describe("DashboardAPI master password", () => {
     dashboard.id = dashboardId;
     dashboard.isPublicDashboard = true;
     dashboard.enableMasterPassword = true;
+    dashboard.masterPasswordSalt = PasswordHash.generateSalt();
     dashboard.masterPassword = new HashedString(
-      await HashedString.hashValue(password, EncryptionSecret),
+      await PasswordHash.hash({
+        plainValue: password,
+        salt: dashboard.masterPasswordSalt,
+      }),
       true,
     );
 
@@ -204,6 +209,20 @@ describe("DashboardAPI master password", () => {
     );
   });
 
+  it("verifies a current scrypt password without rewriting it", async () => {
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(DashboardService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(updateSpy).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+  });
+
   it("rejects an incorrect password without issuing a cookie", async () => {
     mockRequest.body["password"] = "incorrect password";
 
@@ -222,4 +241,156 @@ describe("DashboardAPI master password", () => {
     expect(mockResponse.cookie).not.toHaveBeenCalled();
     expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
   });
+
+  it.each([123, { password: "nested" }, [password]])(
+    "rejects a non-string password body (%p) before hash verification",
+    async (invalidPassword: unknown) => {
+      (mockRequest.body as Record<string, unknown>)["password"] =
+        invalidPassword;
+      const verifySpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+        DashboardService,
+        "verifyHashedColumnValue",
+      );
+
+      await mockRouter
+        .match("post", "/dashboard/master-password/:dashboardId")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledTimes(1);
+      const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+      expect(error).toBeInstanceOf(BadDataException);
+      expect((error as BadDataException).message).toBe(
+        "Master password is required.",
+      );
+      expect(verifySpy).not.toHaveBeenCalled();
+      expect(DashboardService.findOneById).not.toHaveBeenCalled();
+      expect(mockResponse.cookie).not.toHaveBeenCalled();
+    },
+  );
+
+  it("uses this dashboard's selected salt when checking the password", async () => {
+    dashboard.masterPasswordSalt = PasswordHash.generateSalt();
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+    expect(error).toBeInstanceOf(BadDataException);
+    expect((error as BadDataException).message).toBe(
+      DASHBOARD_MASTER_PASSWORD_INVALID_MESSAGE,
+    );
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+  });
+
+  it("selects the salt needed for verification but never exposes either credential column", async () => {
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(DashboardService.findOneById).toHaveBeenCalledWith(
+      expect.objectContaining({
+        select: expect.objectContaining({
+          masterPassword: true,
+          masterPasswordSalt: true,
+        }),
+      }),
+    );
+    expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+      mockRequest,
+      mockResponse,
+    );
+    expect(Response.sendEntityResponse).not.toHaveBeenCalled();
+    expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+    expect(mockResponse.send).not.toHaveBeenCalled();
+    expect(mockResponse.json).not.toHaveBeenCalled();
+
+    const cookieArguments: Array<unknown> = (mockResponse.cookie as jest.Mock)
+      .mock.calls[0] as Array<unknown>;
+    const serializedCookieArguments: string = JSON.stringify(cookieArguments);
+
+    expect(serializedCookieArguments).not.toContain(password);
+    expect(serializedCookieArguments).not.toContain(
+      dashboard.masterPassword!.toString(),
+    );
+    expect(serializedCookieArguments).not.toContain(
+      dashboard.masterPasswordSalt,
+    );
+  });
+
+  it("accepts a legacy unsalted SHA-256 password and upgrades it to scrypt", async () => {
+    dashboard.masterPassword = new HashedString(
+      await HashedString.hashValue(password, EncryptionSecret),
+      true,
+    );
+    delete dashboard.masterPasswordSalt;
+
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(DashboardService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+    expect(updateSpy).toHaveBeenCalledTimes(1);
+
+    const update: {
+      id: ObjectID;
+      data: Record<string, unknown>;
+      expectedData?: Record<string, unknown>;
+      skipUpdateDateColumn?: boolean;
+    } = updateSpy.mock.calls[0]![0] as unknown as {
+      id: ObjectID;
+      data: Record<string, unknown>;
+      expectedData?: Record<string, unknown>;
+      skipUpdateDateColumn?: boolean;
+    };
+
+    expect(update.id.toString()).toBe(dashboardId.toString());
+    expect(update.skipUpdateDateColumn).toBe(true);
+    expect(update.data["masterPassword"]).toEqual(
+      expect.stringMatching(/^scrypt\$/),
+    );
+    expect(update.data["masterPasswordSalt"]).toEqual(
+      expect.stringMatching(/^[0-9a-f]{64}$/),
+    );
+    expect(update.expectedData).toEqual({
+      masterPassword: dashboard.masterPassword!.toString(),
+      masterPasswordSalt: null,
+    });
+    await expect(
+      PasswordHash.verify({
+        plainValue: password,
+        storedValue: update.data["masterPassword"] as string,
+        salt: update.data["masterPasswordSalt"] as string,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  it("does not upgrade a legacy hash when the password is wrong", async () => {
+    dashboard.masterPassword = new HashedString(
+      await HashedString.hashValue(password, EncryptionSecret),
+      true,
+    );
+    delete dashboard.masterPasswordSalt;
+    mockRequest.body["password"] = "incorrect password";
+
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(DashboardService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    expect(updateSpy).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+  });
 });

package/Tests/Server/API/StatusPageMasterPasswordAPI.test.ts

@@ -0,0 +1,335 @@
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import StatusPageAPI from "../../../Server/API/StatusPageAPI";
+import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import CookieUtil from "../../../Server/Utils/Cookie";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import PasswordHash from "../../../Server/Utils/PasswordHash";
+import Response from "../../../Server/Utils/Response";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import HashedString from "../../../Types/HashedString";
+import ObjectID from "../../../Types/ObjectID";
+import { MASTER_PASSWORD_INVALID_MESSAGE } from "../../../Types/StatusPage/MasterPassword";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendJsonObjectResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendErrorResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+  };
+});
+
+describe("StatusPageAPI master password", () => {
+  const password: string = "correct horse battery staple";
+
+  let statusPageId: ObjectID;
+  let statusPage: StatusPage;
+  let mockRequest: ExpressRequest;
+  let mockResponse: ExpressResponse;
+  let nextFunction: NextFunction;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new StatusPageAPI();
+  });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+
+    statusPageId = ObjectID.generate();
+    statusPage = new StatusPage();
+    statusPage.id = statusPageId;
+    statusPage.isPublicStatusPage = false;
+    statusPage.enableMasterPassword = true;
+    statusPage.masterPasswordSalt = PasswordHash.generateSalt();
+    statusPage.masterPassword = new HashedString(
+      await PasswordHash.hash({
+        plainValue: password,
+        salt: statusPage.masterPasswordSalt,
+      }),
+      true,
+    );
+
+    jest.spyOn(StatusPageService, "findOneById").mockResolvedValue(statusPage);
+
+    mockRequest = {
+      params: {
+        statusPageId: statusPageId.toString(),
+      },
+      body: {
+        password,
+      },
+      cookies: {},
+      headers: {},
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    mockResponse = {
+      cookie: jest.fn(),
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+
+    nextFunction = jest.fn();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("issues a status-page-scoped cookie for the correct current scrypt password", async () => {
+    await mockRouter
+      .match("post", "/status-page/master-password/:statusPageId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+      mockRequest,
+      mockResponse,
+    );
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+
+    const cookieCall: Array<unknown> = (mockResponse.cookie as jest.Mock).mock
+      .calls[0] as Array<unknown>;
+    const cookieName: string = cookieCall[0] as string;
+    const cookieToken: string = cookieCall[1] as string;
+
+    expect(cookieName).toBe(
+      CookieUtil.getStatusPageMasterPasswordKey(statusPageId),
+    );
+
+    const unlockedRequest: ExpressRequest = {
+      cookies: {
+        [cookieName]: cookieToken,
+      },
+      headers: {},
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    await expect(
+      StatusPageService.hasReadAccess({
+        statusPageId,
+        req: unlockedRequest,
+      }),
+    ).resolves.toEqual({ hasReadAccess: true });
+  });
+
+  it("does not rewrite a hash already using current scrypt parameters", async () => {
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(StatusPageService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/status-page/master-password/:statusPageId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(updateSpy).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+  });
+
+  it("rejects an incorrect password without issuing a cookie", async () => {
+    mockRequest.body["password"] = "incorrect password";
+
+    await mockRouter
+      .match("post", "/status-page/master-password/:statusPageId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+    expect(error).toBeInstanceOf(BadDataException);
+    expect((error as BadDataException).message).toBe(
+      MASTER_PASSWORD_INVALID_MESSAGE,
+    );
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+    expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
+  });
+
+  it.each([123, { password: "nested" }, [password]])(
+    "rejects a non-string password body (%p) before hash verification",
+    async (invalidPassword: unknown) => {
+      (mockRequest.body as Record<string, unknown>)["password"] =
+        invalidPassword;
+      const verifySpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+        StatusPageService,
+        "verifyHashedColumnValue",
+      );
+
+      await mockRouter
+        .match("post", "/status-page/master-password/:statusPageId")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledTimes(1);
+      const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+      expect(error).toBeInstanceOf(BadDataException);
+      expect((error as BadDataException).message).toBe(
+        "Master password is required.",
+      );
+      expect(verifySpy).not.toHaveBeenCalled();
+      expect(StatusPageService.findOneById).not.toHaveBeenCalled();
+      expect(mockResponse.cookie).not.toHaveBeenCalled();
+    },
+  );
+
+  it("uses this status page's selected salt when checking the password", async () => {
+    statusPage.masterPasswordSalt = PasswordHash.generateSalt();
+
+    await mockRouter
+      .match("post", "/status-page/master-password/:statusPageId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+    expect(error).toBeInstanceOf(BadDataException);
+    expect((error as BadDataException).message).toBe(
+      MASTER_PASSWORD_INVALID_MESSAGE,
+    );
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+  });
+
+  it("selects the salt needed for verification but never exposes either credential column", async () => {
+    await mockRouter
+      .match("post", "/status-page/master-password/:statusPageId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(StatusPageService.findOneById).toHaveBeenCalledWith(
+      expect.objectContaining({
+        select: expect.objectContaining({
+          masterPassword: true,
+          masterPasswordSalt: true,
+        }),
+      }),
+    );
+    expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+      mockRequest,
+      mockResponse,
+    );
+    expect(Response.sendEntityResponse).not.toHaveBeenCalled();
+    expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+    expect(mockResponse.send).not.toHaveBeenCalled();
+    expect(mockResponse.json).not.toHaveBeenCalled();
+
+    const cookieArguments: Array<unknown> = (mockResponse.cookie as jest.Mock)
+      .mock.calls[0] as Array<unknown>;
+    const serializedCookieArguments: string = JSON.stringify(cookieArguments);
+
+    expect(serializedCookieArguments).not.toContain(password);
+    expect(serializedCookieArguments).not.toContain(
+      statusPage.masterPassword!.toString(),
+    );
+    expect(serializedCookieArguments).not.toContain(
+      statusPage.masterPasswordSalt,
+    );
+  });
+
+  it("accepts a legacy unsalted SHA-256 password and upgrades it to scrypt", async () => {
+    statusPage.masterPassword = new HashedString(
+      await HashedString.hashValue(password, EncryptionSecret),
+      true,
+    );
+    delete statusPage.masterPasswordSalt;
+
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(StatusPageService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/status-page/master-password/:statusPageId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+    expect(updateSpy).toHaveBeenCalledTimes(1);
+
+    const update: {
+      id: ObjectID;
+      data: Record<string, unknown>;
+      expectedData?: Record<string, unknown>;
+      skipUpdateDateColumn?: boolean;
+    } = updateSpy.mock.calls[0]![0] as unknown as {
+      id: ObjectID;
+      data: Record<string, unknown>;
+      expectedData?: Record<string, unknown>;
+      skipUpdateDateColumn?: boolean;
+    };
+
+    expect(update.id.toString()).toBe(statusPageId.toString());
+    expect(update.skipUpdateDateColumn).toBe(true);
+    expect(update.data["masterPassword"]).toEqual(
+      expect.stringMatching(/^scrypt\$/),
+    );
+    expect(update.data["masterPasswordSalt"]).toEqual(
+      expect.stringMatching(/^[0-9a-f]{64}$/),
+    );
+    expect(update.expectedData).toEqual({
+      masterPassword: statusPage.masterPassword!.toString(),
+      masterPasswordSalt: null,
+    });
+    await expect(
+      PasswordHash.verify({
+        plainValue: password,
+        storedValue: update.data["masterPassword"] as string,
+        salt: update.data["masterPasswordSalt"] as string,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  it("does not upgrade a legacy hash when the password is wrong", async () => {
+    statusPage.masterPassword = new HashedString(
+      await HashedString.hashValue(password, EncryptionSecret),
+      true,
+    );
+    delete statusPage.masterPasswordSalt;
+    mockRequest.body["password"] = "incorrect password";
+
+    const updateSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(StatusPageService, "updateColumnsByIdWithoutHooks")
+      .mockResolvedValue(undefined);
+
+    await mockRouter
+      .match("post", "/status-page/master-password/:statusPageId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    expect(updateSpy).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Services/AIRunCodeFixClaim.test.ts

@@ -38,6 +38,14 @@ function fakeQueuedRun(data?: {
   } as unknown as AIRun;
 }
 
+function investigationTaskContext(): CodeFixTaskContext {
+  return {
+    sourceInvestigationRunId: ObjectID.generate().toString(),
+    sourceInvestigationAnalysisMarkdown:
+      "## Root cause\n\nA repository code change fixes this regression.",
+  };
+}
+
 describe("AIRunService.claimNextQueuedCodeFixRun", () => {
   afterEach(() => {
     jest.restoreAllMocks();
@@ -193,15 +201,16 @@ describe("AIRunService.claimNextQueuedCodeFixRun", () => {
   });
 
   /*
-   * FixFromIncident is the second incident/alert-subject recipe: enqueued
-   * by the user from the investigation panel, no telemetry exception — the
-   * same recipe grouping as ImproveInstrumentation in the guard.
+   * FixFromIncident is an incident/alert-subject recipe with one additional
+   * requirement: the exact Recommended investigation + analysis are pinned
+   * in taskContext so a later RootCause cannot change what the worker fixes.
    */
-  test("a FixFromIncident run without an exception but with an incident subject is claimed, not errored", async () => {
+  test("a FixFromIncident run with an incident and pinned investigation snapshot is claimed", async () => {
     const run: AIRun = fakeQueuedRun({
       exceptionId: null,
       codeFixTaskType: CodeFixTaskType.FixFromIncident,
       incidentId: ObjectID.generate(),
+      taskContext: investigationTaskContext(),
     });
 
     jest.spyOn(AIRunService, "findOneBy").mockResolvedValue(run);
@@ -219,11 +228,12 @@ describe("AIRunService.claimNextQueuedCodeFixRun", () => {
     expect(transition).toHaveBeenCalledTimes(1);
   });
 
-  test("a FixFromIncident run with an alert subject is claimed too", async () => {
+  test("a FixFromIncident run with an alert and pinned investigation snapshot is claimed too", async () => {
     const run: AIRun = fakeQueuedRun({
       exceptionId: null,
       codeFixTaskType: CodeFixTaskType.FixFromIncident,
       alertId: ObjectID.generate(),
+      taskContext: investigationTaskContext(),
     });
 
     jest.spyOn(AIRunService, "findOneBy").mockResolvedValue(run);
@@ -236,6 +246,50 @@ describe("AIRunService.claimNextQueuedCodeFixRun", () => {
     expect(claimed).toBe(run);
   });
 
+  test.each([
+    ["no", undefined],
+    ["a partial", { sourceInvestigationRunId: ObjectID.generate().toString() }],
+  ] as Array<[string, CodeFixTaskContext | undefined]>)(
+    "a FixFromIncident run with %s pinned snapshot is finalized as Error and skipped",
+    async (_label: string, taskContext: CodeFixTaskContext | undefined) => {
+      const brokenRun: AIRun = fakeQueuedRun({
+        exceptionId: null,
+        codeFixTaskType: CodeFixTaskType.FixFromIncident,
+        incidentId: ObjectID.generate(),
+        ...(taskContext ? { taskContext } : {}),
+      });
+      const goodRun: AIRun = fakeQueuedRun();
+
+      jest
+        .spyOn(AIRunService, "findOneBy")
+        .mockResolvedValueOnce(brokenRun)
+        .mockResolvedValueOnce(goodRun);
+      const transition: jest.SpyInstance = jest
+        .spyOn(AIRunService, "attemptStatusTransition")
+        .mockResolvedValue(1);
+
+      const claimed: AIRun | null =
+        await AIRunService.claimNextQueuedCodeFixRun({
+          aiAgentId: ObjectID.generate(),
+        });
+
+      expect(claimed).toBe(goodRun);
+      expect(transition).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({
+          aiRunId: brokenRun.id,
+          fromStatus: AIRunStatus.Running,
+          set: expect.objectContaining({
+            status: AIRunStatus.Error,
+            errorMessage: expect.stringContaining(
+              "pinned investigation analysis snapshot",
+            ),
+          }),
+        }),
+      );
+    },
+  );
+
   test("a FixFromIncident run with NO subject at all is finalized as Error and skipped", async () => {
     const brokenRun: AIRun = fakeQueuedRun({
       exceptionId: null,