@oneuptime/common 12.0.4 → 12.0.6

package/Tests/Models/DatabaseModels/DataSourceModelSecrets.test.ts

@@ -0,0 +1,70 @@
+import DataSource from "../../../Models/DatabaseModels/DataSource";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import Permission from "../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * The entire mechanism keeping data source credentials out of API
+ * responses is (a) `encrypted: true` so they're ciphertext at rest and
+ * (b) `read: []` so the CRUD layer never serves the (auto-decrypted)
+ * plaintext. Decryption happens automatically on every server-side find,
+ * so a single permission added to a secret column's read list would leak
+ * plaintext credentials to that role. These tests pin both properties.
+ */
+
+const SECRET_COLUMNS: Array<string> = ["password", "apiToken", "customHeaders"];
+
+describe("DataSource model credential columns", () => {
+  const model: DataSource = new DataSource();
+  const accessControl: Record<string, ColumnAccessControl> =
+    model.getColumnAccessControlForAllColumns();
+
+  it("encrypts every secret column at rest", () => {
+    const encryptedColumns: Array<string> = model.getEncryptedColumns().columns;
+
+    for (const column of SECRET_COLUMNS) {
+      expect(encryptedColumns).toContain(column);
+    }
+  });
+
+  it("never exposes a secret column through the CRUD read path", () => {
+    for (const column of SECRET_COLUMNS) {
+      const columnAccessControl: ColumnAccessControl | undefined =
+        accessControl[column];
+      expect(columnAccessControl).toBeDefined();
+      expect(columnAccessControl!.read).toEqual([]);
+    }
+  });
+
+  it("keeps secret columns writable so users can set and rotate them", () => {
+    for (const column of SECRET_COLUMNS) {
+      const columnAccessControl: ColumnAccessControl | undefined =
+        accessControl[column];
+      expect(columnAccessControl!.create.length).toBeGreaterThan(0);
+      expect(columnAccessControl!.update.length).toBeGreaterThan(0);
+    }
+  });
+
+  it("keeps non-secret connection columns readable for the settings UI", () => {
+    for (const column of [
+      "name",
+      "dataSourceType",
+      "url",
+      "databaseHost",
+      "databasePort",
+      "databaseName",
+      "username",
+    ]) {
+      const columnAccessControl: ColumnAccessControl | undefined =
+        accessControl[column];
+      expect(columnAccessControl).toBeDefined();
+      expect(columnAccessControl!.read).toContain(Permission.ReadDataSource);
+    }
+  });
+
+  it("lets project viewers read the table so dashboards render for them", () => {
+    const tableReadPermissions: Array<Permission> = model.getReadPermissions();
+    expect(tableReadPermissions).toContain(Permission.Viewer);
+    expect(tableReadPermissions).toContain(Permission.ProjectMember);
+  });
+});

package/Tests/Models/DatabaseModels/PermissionCatalogueCoverage.test.ts

@@ -0,0 +1,243 @@
+import AllModelTypes from "../../../Models/DatabaseModels/Index";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Permission, {
+  PermissionHelper,
+  PermissionProps,
+} from "../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Contract under test: every permission a model gates CRUD on must exist in the
+ * permission catalogue, and a model must not gate its own columns on another
+ * model's permission.
+ *
+ * The case that prompted this: ScheduledMaintenanceTemplateOwnerUser gated its
+ * required, non-nullable scheduledMaintenanceTemplateId column on the *Team*
+ * create permission. It was invisible only because the two enum values happened
+ * to collide, so both names resolved to one string. The moment that collision
+ * was fixed the mis-key became a hard BadDataException on every create, on a
+ * column the dashboard always sends — a latent break sitting behind an
+ * unrelated bug.
+ *
+ * Sweeping every model rather than asserting on a list is the point: a mis-key
+ * in a model nobody is looking at fails here instead of in production. The
+ * sweep found twenty-one more of them, listed below; they are recorded as a
+ * baseline rather than fixed, because each needs its own judgement about which
+ * permission was meant.
+ */
+
+type ModelType = { new (): BaseModel };
+
+const MODEL_TYPES: Array<ModelType> = AllModelTypes as Array<ModelType>;
+
+/*
+ * The only two permissions a model may reference without a PermissionProps
+ * entry. Both are internal markers rather than capabilities an administrator
+ * hands out — AuthenticatedRequest marks "some authenticated principal made
+ * this call" and UnAuthorizedSsoUser marks a user who has not yet passed the
+ * project's SSO. Neither belongs in the picker, so neither has props.
+ *
+ * Anything else appearing here means a permission is referenced by a live model
+ * but cannot be granted on its own, which is a bug, not a policy.
+ */
+const PERMISSIONS_WITHOUT_PROPS_BY_DESIGN: Array<string> = [
+  "AuthenticatedRequest",
+  "UnAuthorizedSsoUser",
+];
+
+/*
+ * Columns whose create list requires a granular permission the table's own
+ * create list never accepts. Each is a pre-existing copy-paste mis-key of the
+ * same family as the ScheduledMaintenanceTemplateOwnerUser one this test was
+ * written for — MonitorFeed asking for CreateScheduledMaintenanceFeed,
+ * MetricType asking for CreateProjectIncident, and so on. They are recorded
+ * rather than fixed here because each needs its own judgement about which
+ * permission was intended, and because a required column gated this way cannot
+ * be set by a granular-only holder at all.
+ *
+ * This list must only ever shrink. A new entry means a new mis-key.
+ */
+const KNOWN_CROSS_MODEL_COLUMN_GATES: Array<string> = [
+  "IncidentFeed.postedAt requires CreateScheduledMaintenanceFeed",
+  "IncidentFeed.user requires CreateScheduledMaintenanceFeed",
+  "IncidentFeed.userId requires CreateScheduledMaintenanceFeed",
+  "MetricType.services requires CreateProjectIncident",
+  "Monitor.currentMonitorStatusId requires CreateProjectIncident",
+  "MonitorFeed.postedAt requires CreateScheduledMaintenanceFeed",
+  "MonitorFeed.user requires CreateScheduledMaintenanceFeed",
+  "MonitorFeed.userId requires CreateScheduledMaintenanceFeed",
+  "MonitorSecret.monitors requires ReadMonitorSecret",
+  "OnCallDutyPolicyFeed.postedAt requires CreateScheduledMaintenanceFeed",
+  "OnCallDutyPolicyFeed.user requires CreateScheduledMaintenanceFeed",
+  "OnCallDutyPolicyFeed.userId requires CreateScheduledMaintenanceFeed",
+  "Project.businessDetails requires ManageProjectBilling",
+  "Project.businessDetailsCountry requires ManageProjectBilling",
+  "Project.createdByUser requires CurrentUser",
+  "Project.createdByUserId requires CurrentUser",
+  "Project.financeAccountingEmail requires ManageProjectBilling",
+  "Project.paymentProviderPlanId requires CurrentUser",
+  "Project.sendInvoicesByEmail requires ManageProjectBilling",
+  "RunbookSecret.runners requires ReadRunbookSecret",
+  "ScheduledMaintenance.subscriberNotificationStatusMessage requires CreateIncidentPublicNote",
+];
+
+function modelName(modelType: ModelType): string {
+  return modelType.name;
+}
+
+function tableLevelPermissions(model: BaseModel): Array<Permission> {
+  return [
+    ...(model.createRecordPermissions || []),
+    ...(model.readRecordPermissions || []),
+    ...(model.updateRecordPermissions || []),
+    ...(model.deleteRecordPermissions || []),
+  ];
+}
+
+function columnLevelPermissions(model: BaseModel): Array<Permission> {
+  const permissions: Array<Permission> = [];
+
+  for (const column of model.getTableColumns().columns) {
+    const accessControl: ReturnType<BaseModel["getColumnAccessControlFor"]> =
+      model.getColumnAccessControlFor(column);
+
+    if (!accessControl) {
+      continue;
+    }
+
+    permissions.push(
+      ...(accessControl.create || []),
+      ...(accessControl.read || []),
+      ...(accessControl.update || []),
+    );
+  }
+
+  return permissions;
+}
+
+describe("Permission catalogue coverage across database models", () => {
+  test("every model-referenced permission is a real enum member", () => {
+    const validValues: Set<string> = new Set(Object.values(Permission));
+    const unknown: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      for (const permission of [
+        ...tableLevelPermissions(model),
+        ...columnLevelPermissions(model),
+      ]) {
+        if (!validValues.has(permission as unknown as string)) {
+          unknown.push(`${modelName(modelType)} -> ${permission}`);
+        }
+      }
+    }
+
+    expect(unknown).toEqual([]);
+  });
+
+  test("every model-referenced permission resolves to a props entry", () => {
+    const withProps: Set<string> = new Set(
+      PermissionHelper.getAllPermissionProps().map((props: PermissionProps) => {
+        return props.permission.toString();
+      }),
+    );
+
+    const allowed: Set<string> = new Set(PERMISSIONS_WITHOUT_PROPS_BY_DESIGN);
+
+    const missing: Set<string> = new Set<string>();
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      for (const permission of [
+        ...tableLevelPermissions(model),
+        ...columnLevelPermissions(model),
+      ]) {
+        const value: string = permission.toString();
+
+        if (withProps.has(value) || allowed.has(value)) {
+          continue;
+        }
+
+        missing.add(`${modelName(modelType)} -> ${value}`);
+      }
+    }
+
+    expect(Array.from(missing).sort()).toEqual([]);
+  });
+
+  test("the by-design exemptions really have no props", () => {
+    /*
+     * If somebody gives one of these a props entry, the exemption must go too —
+     * otherwise it keeps excusing a permission that no longer needs it, and the
+     * next genuinely-missing one hides behind it.
+     */
+    const withProps: Set<string> = new Set(
+      PermissionHelper.getAllPermissionProps().map((props: PermissionProps) => {
+        return props.permission.toString();
+      }),
+    );
+
+    const stale: Array<string> = PERMISSIONS_WITHOUT_PROPS_BY_DESIGN.filter(
+      (permission: string) => {
+        return withProps.has(permission);
+      },
+    );
+
+    expect(stale).toEqual([]);
+  });
+
+  test("no column is gated on a granular permission its table does not accept", () => {
+    /*
+     * A column's create list must not require a granular permission that the
+     * table's own create list never accepts — the caller would pass the table
+     * gate and then fail on the column, which for a required column means the
+     * record can never be created by that permission at all. Roles are excluded
+     * because they legitimately appear in different combinations.
+     */
+    const rolePermissions: Set<string> = new Set(
+      PermissionHelper.getRolePermissionProps().map(
+        (props: PermissionProps) => {
+          return props.permission.toString();
+        },
+      ),
+    );
+
+    const offenders: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      const tableCreate: Set<string> = new Set(
+        (model.createRecordPermissions || []).map((permission: Permission) => {
+          return permission.toString();
+        }),
+      );
+
+      if (tableCreate.size === 0) {
+        continue;
+      }
+
+      for (const column of model.getTableColumns().columns) {
+        const accessControl: ReturnType<
+          BaseModel["getColumnAccessControlFor"]
+        > = model.getColumnAccessControlFor(column);
+
+        for (const permission of accessControl?.create || []) {
+          const value: string = permission.toString();
+
+          if (rolePermissions.has(value) || tableCreate.has(value)) {
+            continue;
+          }
+
+          offenders.push(`${modelName(modelType)}.${column} requires ${value}`);
+        }
+      }
+    }
+
+    expect(offenders.sort()).toEqual(
+      KNOWN_CROSS_MODEL_COLUMN_GATES.slice().sort(),
+    );
+  });
+});

package/Tests/Server/API/AIAgentDataFixFromIncidentContext.test.ts

@@ -0,0 +1,266 @@
+import AIAgentDataAPI from "../../../Server/API/AIAgentDataAPI";
+import AIRunService from "../../../Server/Services/AIRunService";
+import AlertService from "../../../Server/Services/AlertService";
+import CodeRepositoryService from "../../../Server/Services/CodeRepositoryService";
+import IncidentService from "../../../Server/Services/IncidentService";
+import CodeFixAgentAuth, {
+  CodeFixAgentSource,
+} from "../../../Server/Utils/AI/CodeFix/CodeFixAgentAuth";
+import PostedRootCause from "../../../Server/Utils/AI/SRE/PostedRootCause";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import AIRun from "../../../Models/DatabaseModels/AIRun";
+import Alert from "../../../Models/DatabaseModels/Alert";
+import Incident from "../../../Models/DatabaseModels/Incident";
+import AIRunType from "../../../Types/AI/AIRunType";
+import CodeFixTaskContext from "../../../Types/AI/CodeFixTaskContext";
+import CodeFixTaskType from "../../../Types/AI/CodeFixTaskType";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import type { SpyInstance } from "jest-mock";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+    redirect: jest.fn(),
+  };
+});
+
+const DETAILS_ROUTE: string = "/ai-agent-data/get-instrumentation-task-details";
+const PINNED_ANALYSIS: string =
+  "## Pinned root cause\n\nA repository code change fixes regression A.";
+
+function jsonResponse(): JSONObject | undefined {
+  const sendJson: jest.Mock =
+    Response.sendJsonObjectResponse as unknown as jest.Mock;
+
+  return sendJson.mock.calls[0]?.[2] as JSONObject | undefined;
+}
+
+function thrownError(): Error | undefined {
+  const sendError: jest.Mock =
+    Response.sendErrorResponse as unknown as jest.Mock;
+
+  return sendError.mock.calls[0]?.[2] as Error | undefined;
+}
+
+describe("FixFromIncident task-details investigation snapshot", () => {
+  let projectId: ObjectID;
+  let taskId: ObjectID;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new AIAgentDataAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    projectId = ObjectID.generate();
+    taskId = ObjectID.generate();
+
+    jest.spyOn(CodeFixAgentAuth, "resolveAgentIdentity").mockResolvedValue({
+      id: ObjectID.generate(),
+      projectId,
+      source: CodeFixAgentSource.AIAgent,
+    });
+    jest
+      .spyOn(CodeFixAgentAuth, "deniesAccessToProject")
+      .mockReturnValue(false);
+    jest
+      .spyOn(CodeRepositoryService, "resolveRepositoryForException")
+      .mockResolvedValue(null);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function fixRun(data: {
+    incidentId?: ObjectID | undefined;
+    alertId?: ObjectID | undefined;
+    taskContext?: CodeFixTaskContext | undefined;
+    taskType?: CodeFixTaskType | undefined;
+  }): AIRun {
+    return {
+      id: taskId,
+      projectId,
+      runType: AIRunType.CodeFix,
+      codeFixTaskType: data.taskType || CodeFixTaskType.FixFromIncident,
+      triggeredByIncidentId: data.incidentId,
+      triggeredByAlertId: data.alertId,
+      taskContext: data.taskContext,
+    } as unknown as AIRun;
+  }
+
+  function snapshot(runId: ObjectID): CodeFixTaskContext {
+    return {
+      sourceInvestigationRunId: runId.toString(),
+      sourceInvestigationAnalysisMarkdown: PINNED_ANALYSIS,
+    };
+  }
+
+  async function callRoute(): Promise<void> {
+    const req: ExpressRequest = {
+      params: {},
+      query: {},
+      body: {
+        aiAgentId: ObjectID.generate().toString(),
+        aiAgentKey: "agent-key",
+        taskId: taskId.toString(),
+      },
+      headers: {},
+    } as unknown as ExpressRequest;
+    const res: ExpressResponse = {} as ExpressResponse;
+    const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+    await mockRouter
+      .match("POST", DETAILS_ROUTE)
+      .handlerFunction(req, res, next);
+  }
+
+  test("incident task serves its frozen analysis without re-reading a newer report", async () => {
+    const incidentId: ObjectID = ObjectID.generate();
+    jest
+      .spyOn(AIRunService, "findOneById")
+      .mockResolvedValue(
+        fixRun({ incidentId, taskContext: snapshot(ObjectID.generate()) }),
+      );
+    jest.spyOn(IncidentService, "findOneById").mockResolvedValue({
+      title: "Checkout failures",
+      monitors: [{ name: "checkout-api" }],
+    } as unknown as Incident);
+    const getForIncident: SpyInstance<typeof PostedRootCause.getForIncident> =
+      jest.spyOn(PostedRootCause, "getForIncident");
+
+    await callRoute();
+
+    expect(thrownError()).toBeUndefined();
+    expect(getForIncident).not.toHaveBeenCalled();
+    expect(jsonResponse()).toEqual(
+      expect.objectContaining({
+        subjectType: "incident",
+        analysisMarkdown: PINNED_ANALYSIS,
+      }),
+    );
+  });
+
+  test("alert task serves its frozen analysis without re-reading a newer report", async () => {
+    const alertId: ObjectID = ObjectID.generate();
+    jest
+      .spyOn(AIRunService, "findOneById")
+      .mockResolvedValue(
+        fixRun({ alertId, taskContext: snapshot(ObjectID.generate()) }),
+      );
+    jest.spyOn(AlertService, "findOneById").mockResolvedValue({
+      title: "Latency alert",
+      monitor: { name: "checkout-api" },
+    } as unknown as Alert);
+    const getForAlert: SpyInstance<typeof PostedRootCause.getForAlert> =
+      jest.spyOn(PostedRootCause, "getForAlert");
+
+    await callRoute();
+
+    expect(thrownError()).toBeUndefined();
+    expect(getForAlert).not.toHaveBeenCalled();
+    expect(jsonResponse()).toEqual(
+      expect.objectContaining({
+        subjectType: "alert",
+        analysisMarkdown: PINNED_ANALYSIS,
+      }),
+    );
+  });
+
+  test.each([
+    ["missing", undefined],
+    [
+      "missing analysis",
+      { sourceInvestigationRunId: ObjectID.generate().toString() },
+    ],
+    [
+      "missing run id",
+      { sourceInvestigationAnalysisMarkdown: PINNED_ANALYSIS },
+    ],
+  ] as Array<[string, CodeFixTaskContext | undefined]>)(
+    "%s incident snapshot fails closed without consulting any report",
+    async (_label: string, taskContext: CodeFixTaskContext | undefined) => {
+      const incidentId: ObjectID = ObjectID.generate();
+      jest
+        .spyOn(AIRunService, "findOneById")
+        .mockResolvedValue(fixRun({ incidentId, taskContext }));
+      const getForIncident: SpyInstance<typeof PostedRootCause.getForIncident> =
+        jest.spyOn(PostedRootCause, "getForIncident");
+
+      await callRoute();
+
+      expect(jsonResponse()).toBeUndefined();
+      expect(getForIncident).not.toHaveBeenCalled();
+      expect(thrownError()).toBeInstanceOf(BadDataException);
+      expect(thrownError()?.message).toMatch(/pinned investigation analysis/i);
+    },
+  );
+
+  test("a missing alert snapshot also fails closed without consulting any report", async () => {
+    const alertId: ObjectID = ObjectID.generate();
+    jest
+      .spyOn(AIRunService, "findOneById")
+      .mockResolvedValue(fixRun({ alertId }));
+    const getForAlert: SpyInstance<typeof PostedRootCause.getForAlert> =
+      jest.spyOn(PostedRootCause, "getForAlert");
+
+    await callRoute();
+
+    expect(jsonResponse()).toBeUndefined();
+    expect(getForAlert).not.toHaveBeenCalled();
+    expect(thrownError()).toBeInstanceOf(BadDataException);
+  });
+
+  test("other subject recipes retain the latest posted-report lookup", async () => {
+    const incidentId: ObjectID = ObjectID.generate();
+    const latestAnalysis: string = "## Latest subject report";
+    jest.spyOn(AIRunService, "findOneById").mockResolvedValue(
+      fixRun({
+        incidentId,
+        taskType: CodeFixTaskType.ImproveInstrumentation,
+      }),
+    );
+    jest.spyOn(IncidentService, "findOneById").mockResolvedValue({
+      title: "Checkout failures",
+      monitors: [],
+    } as unknown as Incident);
+    const getForIncident: SpyInstance<typeof PostedRootCause.getForIncident> =
+      jest
+        .spyOn(PostedRootCause, "getForIncident")
+        .mockResolvedValue(latestAnalysis);
+
+    await callRoute();
+
+    expect(getForIncident).toHaveBeenCalledWith(incidentId);
+    expect(jsonResponse()?.["analysisMarkdown"]).toBe(latestAnalysis);
+  });
+});