@oneuptime/common 12.0.4 → 12.0.5

package/Tests/Server/Services/AddMasterPasswordSaltMigration.test.ts

@@ -0,0 +1,283 @@
+import { AddMasterPasswordSalt1786400000000 } from "../../../Server/Infrastructure/Postgres/SchemaMigrations/1786400000000-AddMasterPasswordSalt";
+import SchemaMigrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { describe, expect, test } from "@jest/globals";
+import { QueryRunner } from "typeorm";
+import fs from "fs";
+import path from "path";
+
+/*
+ * Dashboard and status-page master passwords are upgraded from a legacy
+ * unsalted digest to salted scrypt after this migration runs. The salt column
+ * therefore has two unusual requirements:
+ *
+ *   - it must start nullable, because existing hashes have no salt until their
+ *     next successful verification; and
+ *   - it must not be removed while any scrypt hash remains, because a scrypt
+ *     hash cannot be verified without its per-row salt.
+ *
+ * These tests pin that SQL contract without requiring Postgres. In particular,
+ * the rollback tests model each table independently so a future edit cannot
+ * check one table, drop a column, and only then discover that the other table
+ * still contains scrypt credentials.
+ */
+
+const MIGRATION_TIMESTAMP: number = 1786400000000;
+const MIGRATION_FILENAME: string = "1786400000000-AddMasterPasswordSalt.ts";
+const DROP_COLUMN_PATTERN: RegExp = /\bDROP COLUMN\b/i;
+const SELECT_EXISTS_PATTERN: RegExp = /^SELECT EXISTS/i;
+const MIGRATION_PATH: string = path.resolve(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  "Server",
+  "Infrastructure",
+  "Postgres",
+  "SchemaMigrations",
+  MIGRATION_FILENAME,
+);
+
+type TableWithMasterPassword = "Dashboard" | "StatusPage";
+
+type ExistingScryptRows = Record<TableWithMasterPassword, boolean>;
+
+const UNSAFE_ROLLBACK_CASES: Array<[string, ExistingScryptRows]> = [
+  ["Dashboard", { Dashboard: true, StatusPage: false }],
+  ["StatusPage", { Dashboard: false, StatusPage: true }],
+  ["both tables", { Dashboard: true, StatusPage: true }],
+];
+
+type MakeQueryRunnerResult = {
+  runner: QueryRunner;
+  statements: Array<string>;
+};
+
+const makeQueryRunner: (
+  existingScryptRows?: ExistingScryptRows,
+) => MakeQueryRunnerResult = (
+  existingScryptRows: ExistingScryptRows = {
+    Dashboard: false,
+    StatusPage: false,
+  },
+): MakeQueryRunnerResult => {
+  const statements: Array<string> = [];
+
+  const query: (...args: Array<unknown>) => Promise<unknown> = (
+    ...args: Array<unknown>
+  ): Promise<unknown> => {
+    const statement: string = String(args[0]);
+    statements.push(statement);
+
+    for (const table of ["Dashboard", "StatusPage"] as const) {
+      if (statement.includes(`FROM "${table}"`)) {
+        return Promise.resolve([{ exists: existingScryptRows[table] }]);
+      }
+    }
+
+    return Promise.resolve(undefined);
+  };
+
+  return {
+    runner: { query } as unknown as QueryRunner,
+    statements,
+  };
+};
+
+const dropsFrom: (statements: Array<string>) => Array<string> = (
+  statements: Array<string>,
+): Array<string> => {
+  return statements.filter((statement: string) => {
+    return DROP_COLUMN_PATTERN.test(statement);
+  });
+};
+
+const optionalTrailingTimestampFrom: (value: string) => number | null = (
+  value: string,
+): number | null => {
+  const timestamp: string | undefined = value.match(/(\d+)(?:\.ts)?$/)?.[1];
+
+  return timestamp ? Number(timestamp) : null;
+};
+
+const timestampFrom: (value: string) => number = (value: string): number => {
+  const timestamp: number | null = optionalTrailingTimestampFrom(value);
+
+  if (timestamp === null) {
+    throw new Error(`Expected a trailing migration timestamp in: ${value}`);
+  }
+
+  return timestamp;
+};
+
+const timestampFromFilename: (value: string) => number = (
+  value: string,
+): number => {
+  const match: RegExpMatchArray | null = value.match(/^(\d+)-/);
+
+  if (!match?.[1]) {
+    throw new Error(`Expected a leading migration timestamp in: ${value}`);
+  }
+
+  return Number(match[1]);
+};
+
+describe("AddMasterPasswordSalt1786400000000 - up SQL contract", () => {
+  test("adds only the dashboard and status-page salt columns", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().up(runner);
+
+    expect(statements).toEqual([
+      `ALTER TABLE "StatusPage" ADD "masterPasswordSalt" character varying(100)`,
+      `ALTER TABLE "Dashboard" ADD "masterPasswordSalt" character varying(100)`,
+    ]);
+  });
+
+  test("keeps both columns nullable and does not backfill a fake salt", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().up(runner);
+
+    expect(statements).toHaveLength(2);
+
+    for (const statement of statements) {
+      expect(statement).toMatch(
+        /^ALTER TABLE "(?:Dashboard|StatusPage)" ADD "masterPasswordSalt" character varying\(\d+\)$/,
+      );
+      expect(statement).not.toMatch(/NOT NULL/i);
+      expect(statement).not.toMatch(/DEFAULT/i);
+      expect(statement).not.toMatch(/\bUPDATE\b/i);
+      expect(statement).not.toMatch(/\bINSERT\b/i);
+    }
+  });
+
+  test("allocates enough space for the generated 64-character salts", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().up(runner);
+
+    for (const statement of statements) {
+      const width: RegExpMatchArray | null = statement.match(
+        /character varying\((\d+)\)/,
+      );
+
+      expect(width).not.toBeNull();
+      expect(Number(width?.[1])).toBeGreaterThanOrEqual(64);
+    }
+  });
+});
+
+describe("AddMasterPasswordSalt1786400000000 - safe rollback", () => {
+  test("checks both master-password tables before the first DROP", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().down(runner);
+
+    const firstDropIndex: number = statements.findIndex((statement: string) => {
+      return DROP_COLUMN_PATTERN.test(statement);
+    });
+    const dashboardCheckIndex: number = statements.findIndex(
+      (statement: string) => {
+        return (
+          statement.includes(`FROM "Dashboard"`) &&
+          statement.includes(`"masterPassword" LIKE 'scrypt$%'`)
+        );
+      },
+    );
+    const statusPageCheckIndex: number = statements.findIndex(
+      (statement: string) => {
+        return (
+          statement.includes(`FROM "StatusPage"`) &&
+          statement.includes(`"masterPassword" LIKE 'scrypt$%'`)
+        );
+      },
+    );
+
+    expect(dashboardCheckIndex).toBeGreaterThanOrEqual(0);
+    expect(statusPageCheckIndex).toBeGreaterThanOrEqual(0);
+    expect(firstDropIndex).toBeGreaterThan(dashboardCheckIndex);
+    expect(firstDropIndex).toBeGreaterThan(statusPageCheckIndex);
+  });
+
+  test.each(UNSAFE_ROLLBACK_CASES)(
+    "refuses to drop either salt when %s still has a scrypt hash",
+    async (_scenario: string, existingScryptRows: ExistingScryptRows) => {
+      const { runner, statements } = makeQueryRunner(existingScryptRows);
+
+      await expect(
+        new AddMasterPasswordSalt1786400000000().down(runner),
+      ).rejects.toThrow(
+        "Cannot remove master-password salt columns while scrypt master-password hashes exist.",
+      );
+
+      expect(dropsFrom(statements)).toEqual([]);
+      expect(
+        statements.filter((statement: string) => {
+          return SELECT_EXISTS_PATTERN.test(statement);
+        }),
+      ).toHaveLength(2);
+    },
+  );
+
+  test("drops both exact salt columns when neither table has scrypt hashes", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().down(runner);
+
+    expect(dropsFrom(statements)).toEqual([
+      `ALTER TABLE "Dashboard" DROP COLUMN "masterPasswordSalt"`,
+      `ALTER TABLE "StatusPage" DROP COLUMN "masterPasswordSalt"`,
+    ]);
+  });
+});
+
+describe("AddMasterPasswordSalt1786400000000 - identity and registration", () => {
+  test("filename, exported class, and TypeORM name carry one timestamp", () => {
+    const migration: AddMasterPasswordSalt1786400000000 =
+      new AddMasterPasswordSalt1786400000000();
+
+    expect(fs.existsSync(MIGRATION_PATH)).toBe(true);
+    expect(path.basename(MIGRATION_PATH)).toBe(MIGRATION_FILENAME);
+    expect(timestampFromFilename(MIGRATION_FILENAME)).toBe(MIGRATION_TIMESTAMP);
+    expect(timestampFrom(AddMasterPasswordSalt1786400000000.name)).toBe(
+      MIGRATION_TIMESTAMP,
+    );
+    expect(timestampFrom(migration.name)).toBe(MIGRATION_TIMESTAMP);
+    expect(migration.name).toBe("AddMasterPasswordSalt1786400000000");
+  });
+
+  /*
+   * Registration is the invariant that matters — an unregistered migration
+   * never runs. Being LAST is not: it was true the day this landed and every
+   * migration added since has appended after it, so pinning it here would
+   * fail the next person's unrelated PR rather than catch a real defect.
+   */
+  test("is registered exactly once", () => {
+    const occurrences: number = SchemaMigrations.filter(
+      (migration: unknown) => {
+        return migration === AddMasterPasswordSalt1786400000000;
+      },
+    ).length;
+
+    expect(occurrences).toBe(1);
+  });
+
+  test("has a timestamp strictly after every previously registered migration", () => {
+    const migrationIndex: number = SchemaMigrations.indexOf(
+      AddMasterPasswordSalt1786400000000,
+    );
+
+    expect(migrationIndex).toBeGreaterThan(-1);
+
+    for (const earlierMigration of SchemaMigrations.slice(0, migrationIndex)) {
+      const earlierTimestamp: number | null = optionalTrailingTimestampFrom(
+        earlierMigration.name,
+      );
+
+      // The original `InitialMigration` is the sole pre-timestamp convention.
+      if (earlierTimestamp !== null) {
+        expect(earlierTimestamp).toBeLessThan(MIGRATION_TIMESTAMP);
+      }
+    }
+  });
+});

package/Tests/Server/Services/AnalyticsDatabaseService.test.ts

@@ -1,4 +1,6 @@
-import AnalyticsDatabaseService from "../../../Server/Services/AnalyticsDatabaseService";
+import AnalyticsDatabaseService, {
+  MigrationExecuteOptions,
+} from "../../../Server/Services/AnalyticsDatabaseService";
 import {
   SQL,
   Statement,
@@ -930,4 +932,26 @@ describe("AnalyticsDatabaseService", () => {
       });
     });
   });
+
+  describe("MigrationExecuteOptions", () => {
+    /*
+     * Guards the exact regression a customer hit: ON CLUSTER DDL running with
+     * the server-default `throw` output mode aborted the whole migrate Job
+     * with TIMEOUT_EXCEEDED (code 159) when 4 of 5 hosts had a backlogged
+     * DDL queue — even though the queued task completes in the background.
+     */
+    test("migration DDL never throws on distributed DDL confirmation timeout", () => {
+      expect(MigrationExecuteOptions.useMigrationConnection).toBe(true);
+      expect(
+        MigrationExecuteOptions.clickhouseSettings?.distributed_ddl_output_mode,
+      ).toBe("null_status_on_timeout");
+      // Int64 settings travel as strings; default mirrors the server's 180s.
+      expect(
+        String(
+          MigrationExecuteOptions.clickhouseSettings
+            ?.distributed_ddl_task_timeout,
+        ),
+      ).toMatch(/^-?\d+$/);
+    });
+  });
 });

package/Tests/Server/Services/DatabaseServicePerUserPasswordSalt.test.ts

@@ -1,13 +1,13 @@
 import UserService from "../../../Server/Services/UserService";
 import StatusPagePrivateUserService from "../../../Server/Services/StatusPagePrivateUserService";
-import DashboardService from "../../../Server/Services/DashboardService";
+import UserSessionService from "../../../Server/Services/UserSessionService";
 import ColumnPermissions from "../../../Server/Types/Database/Permissions/ColumnPermission";
 import DatabaseRequestType from "../../../Server/Types/BaseDatabase/DatabaseRequestType";
 import PasswordHash from "../../../Server/Utils/PasswordHash";
 import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
 import User from "../../../Models/DatabaseModels/User";
 import StatusPagePrivateUser from "../../../Models/DatabaseModels/StatusPagePrivateUser";
-import Dashboard from "../../../Models/DatabaseModels/Dashboard";
+import UserSession from "../../../Models/DatabaseModels/UserSession";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { TableColumnMetadata } from "../../../Types/Database/TableColumn";
 import TableColumnType from "../../../Types/Database/TableColumnType";
@@ -33,8 +33,8 @@ import { afterEach, describe, expect, jest, test } from "@jest/globals";
  *   - a salt column that forgets `computed: true` breaks every non-root
  *     create of a row carrying a password, because the create permission
  *     check runs AFTER hashing and would reject a column nobody may write;
- *   - a hashed column with no declared salt column (session refresh tokens,
- *     master passwords) must keep hashing exactly as it always did;
+ *   - a hashed column with no declared salt column (session refresh tokens)
+ *     must keep hashing exactly as it always did;
  *   - an update that does not touch the password must not touch the salt,
  *     or every password in the affected rows stops verifying.
  *
@@ -355,56 +355,57 @@ describe("Update path — sanitizeCreateOrUpdate mints a per-record salt", () =>
   });
 });
 
-describe("Hashed columns that declare no salt column are untouched", () => {
-  test("a dashboard master password still uses the legacy unsalted digest", async () => {
-    /*
-     * Dashboard.masterPassword is `hashed: true` with no hashSaltColumn — a
-     * shared secret, not a per-user credential. Every master password
-     * already stored has to keep verifying, so this digest must not move.
-     */
-    const dashboard: Dashboard = new Dashboard();
-    dashboard.masterPassword = new HashedString("master-password");
-
-    await (
-      DashboardService as unknown as { hash: HashFunction<Dashboard> }
-    ).hash(dashboard);
+describe("High-entropy hashed columns remain searchable", () => {
+  test("a session refresh token keeps the fast deterministic SHA-256 digest", async () => {
+    const data: JSONObject = (await (
+      UserSessionService as unknown as {
+        sanitizeCreateOrUpdate: SanitizeFunction;
+      }
+    ).sanitizeCreateOrUpdate(
+      {
+        refreshToken: new HashedString("server-generated-refresh-token"),
+      },
+      { isRoot: true },
+    )) as JSONObject;
 
-    expect(dashboard.masterPassword!.toString()).toBe(
+    expect(data["refreshToken"]).toBe(
       CryptoJS.SHA256(
-        EncryptionSecret.toString() + "master-password",
+        EncryptionSecret.toString() + "server-generated-refresh-token",
       ).toString(),
     );
   });
 
-  test("no stray salt column is invented for it", async () => {
-    const dashboard: Dashboard = new Dashboard();
-    dashboard.masterPassword = new HashedString("master-password");
-
-    await (
-      DashboardService as unknown as { hash: HashFunction<Dashboard> }
-    ).hash(dashboard);
+  test("refresh tokens do not declare or invent a password salt", async () => {
+    const data: JSONObject = (await (
+      UserSessionService as unknown as {
+        sanitizeCreateOrUpdate: SanitizeFunction;
+      }
+    ).sanitizeCreateOrUpdate(
+      {
+        refreshToken: new HashedString("server-generated-refresh-token"),
+      },
+      { isRoot: true },
+    )) as JSONObject;
 
     expect(
-      new Dashboard().getTableColumnMetadata("masterPassword").hashSaltColumn,
-    ).toBeUndefined();
-    expect(
-      (dashboard as unknown as JSONObject)["passwordSalt"],
+      new UserSession().getTableColumnMetadata("refreshToken").hashSaltColumn,
     ).toBeUndefined();
+    expect(data["refreshTokenSalt"]).toBeUndefined();
   });
 
-  test("a bare string is still allowed on an unsalted hashed column", async () => {
-    // The desync guard is scoped to salted columns only.
+  test("a pre-hashed refresh-token digest remains accepted on update", async () => {
     const data: JSONObject = (await (
-      DashboardService as unknown as {
+      UserSessionService as unknown as {
         sanitizeCreateOrUpdate: SanitizeFunction;
       }
     ).sanitizeCreateOrUpdate(
-      { masterPassword: "a-raw-digest" },
+      { refreshToken: "a-raw-digest" },
       { isRoot: true },
       true,
     )) as JSONObject;
 
-    expect(data["masterPassword"]).toBe("a-raw-digest");
+    expect(data["refreshToken"]).toBe("a-raw-digest");
+    expect(data["refreshTokenSalt"]).toBeUndefined();
   });
 });
 
@@ -415,6 +416,7 @@ describe("Hashed columns that declare no salt column are untouched", () => {
 type UpdateColumnsInput = {
   id: ObjectID;
   data: JSONObject;
+  expectedData?: JSONObject;
   skipUpdateDateColumn?: boolean;
 };
 
@@ -597,6 +599,10 @@ describe("verifyHashedColumnValue — transparent upgrade of legacy hashes", ()
 
     expect(write.id.toString()).toBe(user._id);
     expect(write.data["passwordSalt"]).toMatch(/^[0-9a-f]{64}$/);
+    expect(write.expectedData).toEqual({
+      password: user.password!.toString(),
+      passwordSalt: null,
+    });
 
     // The written hash verifies under the written salt.
     await expect(
@@ -726,6 +732,10 @@ describe("verifyHashedColumnValue — transparent upgrade of legacy hashes", ()
 
     expect(captured).toHaveLength(1);
     expect(captured[0]!.data["password"]).toMatch(/^scrypt\$/);
+    expect(captured[0]!.expectedData).toEqual({
+      password: user.password!.toString(),
+      passwordSalt: salt,
+    });
     // A brand new salt, not the interim one it came in with.
     expect(captured[0]!.data["passwordSalt"]).not.toBe(salt);
   });

package/Tests/Server/Services/DatabaseServiceUpdateColumnsWithoutHooks.test.ts

@@ -125,4 +125,58 @@ describe("DatabaseService.updateColumnsByIdWithoutHooks", () => {
       APPLICATION_ID.toString(),
     );
   });
+
+  it("adds null-safe compare-and-set guards for expected values", async () => {
+    const newValue: Date = new Date("2026-08-07T10:00:00.000Z");
+    const oldValue: Date = new Date("2026-08-07T09:00:00.000Z");
+
+    await service.updateColumnsByIdWithoutHooks({
+      id: APPLICATION_ID,
+      data: { lastSeenAt: newValue },
+      expectedData: {
+        sessionReplayLastChunkReceivedAt: oldValue,
+        sessionReplayBudgetExceededAt: null,
+      },
+      skipUpdateDateColumn: true,
+    });
+
+    expect(captured).toEqual([
+      {
+        sql:
+          `UPDATE "RumApplication" SET "lastSeenAt" = $1 ` +
+          `WHERE "_id" = $2 ` +
+          `AND "sessionReplayLastChunkReceivedAt" IS NOT DISTINCT FROM $3 ` +
+          `AND "sessionReplayBudgetExceededAt" IS NOT DISTINCT FROM $4`,
+        params: [newValue, APPLICATION_ID.toString(), oldValue, null],
+      },
+    ]);
+  });
+
+  it("rejects unknown compare-and-set columns before issuing SQL", async () => {
+    await expect(
+      service.updateColumnsByIdWithoutHooks({
+        id: APPLICATION_ID,
+        data: { lastSeenAt: new Date() },
+        expectedData: { notAColumn: "value" } as never,
+      }),
+    ).rejects.toThrow('unknown expected column "notAColumn"');
+
+    expect(captured).toHaveLength(0);
+  });
+
+  it("rejects SQL expressions in compare-and-set values", async () => {
+    await expect(
+      service.updateColumnsByIdWithoutHooks({
+        id: APPLICATION_ID,
+        data: { lastSeenAt: new Date() },
+        expectedData: {
+          sessionReplayLastChunkReceivedAt: (() => {
+            return "NOW()";
+          }) as never,
+        },
+      }),
+    ).rejects.toThrow("SQL-expression expected values are not supported");
+
+    expect(captured).toHaveLength(0);
+  });
 });

package/Tests/Server/Services/FeedAIRunAssociation.test.ts

@@ -0,0 +1,125 @@
+import AlertFeed, {
+  AlertFeedEventType,
+} from "../../../Models/DatabaseModels/AlertFeed";
+import IncidentFeed, {
+  IncidentFeedEventType,
+} from "../../../Models/DatabaseModels/IncidentFeed";
+import AlertFeedService from "../../../Server/Services/AlertFeedService";
+import IncidentFeedService from "../../../Server/Services/IncidentFeedService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import type { TableColumnMetadata } from "../../../Types/Database/TableColumn";
+import TableColumnType from "../../../Types/Database/TableColumnType";
+import ObjectID from "../../../Types/ObjectID";
+import { afterEach, describe, expect, it, jest } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import type { ColumnMetadataArgs } from "typeorm/metadata-args/ColumnMetadataArgs";
+import type { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+);
+const INCIDENT_ID: ObjectID = new ObjectID(
+  "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+);
+const ALERT_ID: ObjectID = new ObjectID("cccccccc-cccc-4ccc-8ccc-cccccccccccc");
+const AI_RUN_ID: ObjectID = new ObjectID(
+  "dddddddd-dddd-4ddd-8ddd-dddddddddddd",
+);
+
+function expectRunAssociationMetadata(
+  model: IncidentFeed | AlertFeed,
+  target: typeof IncidentFeed | typeof AlertFeed,
+  subjectIdColumn: "incidentId" | "alertId",
+): void {
+  expect(model.getTableColumns().columns).toContain("aiRunId");
+
+  const tableColumn: TableColumnMetadata =
+    model.getTableColumnMetadata("aiRunId");
+  expect(tableColumn.type).toBe(TableColumnType.ObjectID);
+  expect(tableColumn.required).toBe(false);
+  expect(tableColumn.canReadOnRelationQuery).toBe(true);
+
+  const databaseColumn: ColumnMetadataArgs | undefined =
+    getMetadataArgsStorage().columns.find((column: ColumnMetadataArgs) => {
+      return column.target === target && column.propertyName === "aiRunId";
+    });
+  expect(databaseColumn?.options.nullable).toBe(true);
+
+  const hasExactLookupIndex: boolean = getMetadataArgsStorage().indices.some(
+    (index: IndexMetadataArgs): boolean => {
+      return (
+        index.target === target &&
+        Array.isArray(index.columns) &&
+        index.columns.length === 2 &&
+        index.columns[0] === subjectIdColumn &&
+        index.columns[1] === "aiRunId"
+      );
+    },
+  );
+  expect(hasExactLookupIndex).toBe(true);
+}
+
+describe("feed AI run association metadata", () => {
+  it("defines a nullable, exact-lookup-indexed incident feed association", () => {
+    expectRunAssociationMetadata(
+      new IncidentFeed(),
+      IncidentFeed,
+      "incidentId",
+    );
+  });
+
+  it("defines a nullable, exact-lookup-indexed alert feed association", () => {
+    expectRunAssociationMetadata(new AlertFeed(), AlertFeed, "alertId");
+  });
+});
+
+describe("feed service AI run persistence", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("copies aiRunId into the incident RootCause row", async () => {
+    jest
+      .spyOn(IncidentFeedService, "create")
+      .mockResolvedValue(new IncidentFeed());
+
+    await IncidentFeedService.createIncidentFeedItem({
+      incidentId: INCIDENT_ID,
+      projectId: PROJECT_ID,
+      aiRunId: AI_RUN_ID,
+      incidentFeedEventType: IncidentFeedEventType.RootCause,
+      feedInfoInMarkdown: "Incident analysis",
+    });
+
+    const createCall: CreateBy<IncidentFeed> = jest.mocked(
+      IncidentFeedService.create,
+    ).mock.calls[0]![0];
+    const createData: IncidentFeed = createCall.data;
+    expect(createData.aiRunId).toEqual(AI_RUN_ID);
+    expect(createData.incidentId).toEqual(INCIDENT_ID);
+    expect(createData.incidentFeedEventType).toBe(
+      IncidentFeedEventType.RootCause,
+    );
+    expect(createCall.props).toEqual({ isRoot: true });
+  });
+
+  it("copies aiRunId into the alert RootCause row", async () => {
+    jest.spyOn(AlertFeedService, "create").mockResolvedValue(new AlertFeed());
+
+    await AlertFeedService.createAlertFeedItem({
+      alertId: ALERT_ID,
+      projectId: PROJECT_ID,
+      aiRunId: AI_RUN_ID,
+      alertFeedEventType: AlertFeedEventType.RootCause,
+      feedInfoInMarkdown: "Alert analysis",
+    });
+
+    const createCall: CreateBy<AlertFeed> = jest.mocked(AlertFeedService.create)
+      .mock.calls[0]![0];
+    const createData: AlertFeed = createCall.data;
+    expect(createData.aiRunId).toEqual(AI_RUN_ID);
+    expect(createData.alertId).toEqual(ALERT_ID);
+    expect(createData.alertFeedEventType).toBe(AlertFeedEventType.RootCause);
+    expect(createCall.props).toEqual({ isRoot: true });
+  });
+});