@oneuptime/common 12.0.4 → 12.0.6

package/Tests/Server/Services/AddMasterPasswordSaltMigration.test.ts

@@ -0,0 +1,283 @@
+import { AddMasterPasswordSalt1786400000000 } from "../../../Server/Infrastructure/Postgres/SchemaMigrations/1786400000000-AddMasterPasswordSalt";
+import SchemaMigrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { describe, expect, test } from "@jest/globals";
+import { QueryRunner } from "typeorm";
+import fs from "fs";
+import path from "path";
+
+/*
+ * Dashboard and status-page master passwords are upgraded from a legacy
+ * unsalted digest to salted scrypt after this migration runs. The salt column
+ * therefore has two unusual requirements:
+ *
+ *   - it must start nullable, because existing hashes have no salt until their
+ *     next successful verification; and
+ *   - it must not be removed while any scrypt hash remains, because a scrypt
+ *     hash cannot be verified without its per-row salt.
+ *
+ * These tests pin that SQL contract without requiring Postgres. In particular,
+ * the rollback tests model each table independently so a future edit cannot
+ * check one table, drop a column, and only then discover that the other table
+ * still contains scrypt credentials.
+ */
+
+const MIGRATION_TIMESTAMP: number = 1786400000000;
+const MIGRATION_FILENAME: string = "1786400000000-AddMasterPasswordSalt.ts";
+const DROP_COLUMN_PATTERN: RegExp = /\bDROP COLUMN\b/i;
+const SELECT_EXISTS_PATTERN: RegExp = /^SELECT EXISTS/i;
+const MIGRATION_PATH: string = path.resolve(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  "Server",
+  "Infrastructure",
+  "Postgres",
+  "SchemaMigrations",
+  MIGRATION_FILENAME,
+);
+
+type TableWithMasterPassword = "Dashboard" | "StatusPage";
+
+type ExistingScryptRows = Record<TableWithMasterPassword, boolean>;
+
+const UNSAFE_ROLLBACK_CASES: Array<[string, ExistingScryptRows]> = [
+  ["Dashboard", { Dashboard: true, StatusPage: false }],
+  ["StatusPage", { Dashboard: false, StatusPage: true }],
+  ["both tables", { Dashboard: true, StatusPage: true }],
+];
+
+type MakeQueryRunnerResult = {
+  runner: QueryRunner;
+  statements: Array<string>;
+};
+
+const makeQueryRunner: (
+  existingScryptRows?: ExistingScryptRows,
+) => MakeQueryRunnerResult = (
+  existingScryptRows: ExistingScryptRows = {
+    Dashboard: false,
+    StatusPage: false,
+  },
+): MakeQueryRunnerResult => {
+  const statements: Array<string> = [];
+
+  const query: (...args: Array<unknown>) => Promise<unknown> = (
+    ...args: Array<unknown>
+  ): Promise<unknown> => {
+    const statement: string = String(args[0]);
+    statements.push(statement);
+
+    for (const table of ["Dashboard", "StatusPage"] as const) {
+      if (statement.includes(`FROM "${table}"`)) {
+        return Promise.resolve([{ exists: existingScryptRows[table] }]);
+      }
+    }
+
+    return Promise.resolve(undefined);
+  };
+
+  return {
+    runner: { query } as unknown as QueryRunner,
+    statements,
+  };
+};
+
+const dropsFrom: (statements: Array<string>) => Array<string> = (
+  statements: Array<string>,
+): Array<string> => {
+  return statements.filter((statement: string) => {
+    return DROP_COLUMN_PATTERN.test(statement);
+  });
+};
+
+const optionalTrailingTimestampFrom: (value: string) => number | null = (
+  value: string,
+): number | null => {
+  const timestamp: string | undefined = value.match(/(\d+)(?:\.ts)?$/)?.[1];
+
+  return timestamp ? Number(timestamp) : null;
+};
+
+const timestampFrom: (value: string) => number = (value: string): number => {
+  const timestamp: number | null = optionalTrailingTimestampFrom(value);
+
+  if (timestamp === null) {
+    throw new Error(`Expected a trailing migration timestamp in: ${value}`);
+  }
+
+  return timestamp;
+};
+
+const timestampFromFilename: (value: string) => number = (
+  value: string,
+): number => {
+  const match: RegExpMatchArray | null = value.match(/^(\d+)-/);
+
+  if (!match?.[1]) {
+    throw new Error(`Expected a leading migration timestamp in: ${value}`);
+  }
+
+  return Number(match[1]);
+};
+
+describe("AddMasterPasswordSalt1786400000000 - up SQL contract", () => {
+  test("adds only the dashboard and status-page salt columns", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().up(runner);
+
+    expect(statements).toEqual([
+      `ALTER TABLE "StatusPage" ADD "masterPasswordSalt" character varying(100)`,
+      `ALTER TABLE "Dashboard" ADD "masterPasswordSalt" character varying(100)`,
+    ]);
+  });
+
+  test("keeps both columns nullable and does not backfill a fake salt", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().up(runner);
+
+    expect(statements).toHaveLength(2);
+
+    for (const statement of statements) {
+      expect(statement).toMatch(
+        /^ALTER TABLE "(?:Dashboard|StatusPage)" ADD "masterPasswordSalt" character varying\(\d+\)$/,
+      );
+      expect(statement).not.toMatch(/NOT NULL/i);
+      expect(statement).not.toMatch(/DEFAULT/i);
+      expect(statement).not.toMatch(/\bUPDATE\b/i);
+      expect(statement).not.toMatch(/\bINSERT\b/i);
+    }
+  });
+
+  test("allocates enough space for the generated 64-character salts", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().up(runner);
+
+    for (const statement of statements) {
+      const width: RegExpMatchArray | null = statement.match(
+        /character varying\((\d+)\)/,
+      );
+
+      expect(width).not.toBeNull();
+      expect(Number(width?.[1])).toBeGreaterThanOrEqual(64);
+    }
+  });
+});
+
+describe("AddMasterPasswordSalt1786400000000 - safe rollback", () => {
+  test("checks both master-password tables before the first DROP", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().down(runner);
+
+    const firstDropIndex: number = statements.findIndex((statement: string) => {
+      return DROP_COLUMN_PATTERN.test(statement);
+    });
+    const dashboardCheckIndex: number = statements.findIndex(
+      (statement: string) => {
+        return (
+          statement.includes(`FROM "Dashboard"`) &&
+          statement.includes(`"masterPassword" LIKE 'scrypt$%'`)
+        );
+      },
+    );
+    const statusPageCheckIndex: number = statements.findIndex(
+      (statement: string) => {
+        return (
+          statement.includes(`FROM "StatusPage"`) &&
+          statement.includes(`"masterPassword" LIKE 'scrypt$%'`)
+        );
+      },
+    );
+
+    expect(dashboardCheckIndex).toBeGreaterThanOrEqual(0);
+    expect(statusPageCheckIndex).toBeGreaterThanOrEqual(0);
+    expect(firstDropIndex).toBeGreaterThan(dashboardCheckIndex);
+    expect(firstDropIndex).toBeGreaterThan(statusPageCheckIndex);
+  });
+
+  test.each(UNSAFE_ROLLBACK_CASES)(
+    "refuses to drop either salt when %s still has a scrypt hash",
+    async (_scenario: string, existingScryptRows: ExistingScryptRows) => {
+      const { runner, statements } = makeQueryRunner(existingScryptRows);
+
+      await expect(
+        new AddMasterPasswordSalt1786400000000().down(runner),
+      ).rejects.toThrow(
+        "Cannot remove master-password salt columns while scrypt master-password hashes exist.",
+      );
+
+      expect(dropsFrom(statements)).toEqual([]);
+      expect(
+        statements.filter((statement: string) => {
+          return SELECT_EXISTS_PATTERN.test(statement);
+        }),
+      ).toHaveLength(2);
+    },
+  );
+
+  test("drops both exact salt columns when neither table has scrypt hashes", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddMasterPasswordSalt1786400000000().down(runner);
+
+    expect(dropsFrom(statements)).toEqual([
+      `ALTER TABLE "Dashboard" DROP COLUMN "masterPasswordSalt"`,
+      `ALTER TABLE "StatusPage" DROP COLUMN "masterPasswordSalt"`,
+    ]);
+  });
+});
+
+describe("AddMasterPasswordSalt1786400000000 - identity and registration", () => {
+  test("filename, exported class, and TypeORM name carry one timestamp", () => {
+    const migration: AddMasterPasswordSalt1786400000000 =
+      new AddMasterPasswordSalt1786400000000();
+
+    expect(fs.existsSync(MIGRATION_PATH)).toBe(true);
+    expect(path.basename(MIGRATION_PATH)).toBe(MIGRATION_FILENAME);
+    expect(timestampFromFilename(MIGRATION_FILENAME)).toBe(MIGRATION_TIMESTAMP);
+    expect(timestampFrom(AddMasterPasswordSalt1786400000000.name)).toBe(
+      MIGRATION_TIMESTAMP,
+    );
+    expect(timestampFrom(migration.name)).toBe(MIGRATION_TIMESTAMP);
+    expect(migration.name).toBe("AddMasterPasswordSalt1786400000000");
+  });
+
+  /*
+   * Registration is the invariant that matters — an unregistered migration
+   * never runs. Being LAST is not: it was true the day this landed and every
+   * migration added since has appended after it, so pinning it here would
+   * fail the next person's unrelated PR rather than catch a real defect.
+   */
+  test("is registered exactly once", () => {
+    const occurrences: number = SchemaMigrations.filter(
+      (migration: unknown) => {
+        return migration === AddMasterPasswordSalt1786400000000;
+      },
+    ).length;
+
+    expect(occurrences).toBe(1);
+  });
+
+  test("has a timestamp strictly after every previously registered migration", () => {
+    const migrationIndex: number = SchemaMigrations.indexOf(
+      AddMasterPasswordSalt1786400000000,
+    );
+
+    expect(migrationIndex).toBeGreaterThan(-1);
+
+    for (const earlierMigration of SchemaMigrations.slice(0, migrationIndex)) {
+      const earlierTimestamp: number | null = optionalTrailingTimestampFrom(
+        earlierMigration.name,
+      );
+
+      // The original `InitialMigration` is the sole pre-timestamp convention.
+      if (earlierTimestamp !== null) {
+        expect(earlierTimestamp).toBeLessThan(MIGRATION_TIMESTAMP);
+      }
+    }
+  });
+});

package/Tests/Server/Services/AlertMetricResourceAttributes.test.ts

@@ -0,0 +1,352 @@
+import Alert from "../../../Models/DatabaseModels/Alert";
+import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
+import AlertState from "../../../Models/DatabaseModels/AlertState";
+import AlertStateTimeline from "../../../Models/DatabaseModels/AlertStateTimeline";
+import Label from "../../../Models/DatabaseModels/Label";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import MutableMetric from "../../../Models/AnalyticsModels/MutableMetric";
+import AlertService from "../../../Server/Services/AlertService";
+import AlertStateTimelineService from "../../../Server/Services/AlertStateTimelineService";
+import GlobalConfigService from "../../../Server/Services/GlobalConfigService";
+import MutableMetricService from "../../../Server/Services/MutableMetricService";
+import Semaphore from "../../../Server/Infrastructure/Semaphore";
+import TelemetryUtil from "../../../Server/Utils/Telemetry/Telemetry";
+import AlertMetricType from "../../../Types/Alerts/AlertMetricType";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const ALERT_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const MONITOR_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+const SEVERITY_ID: ObjectID = new ObjectID(
+  "44444444-4444-4444-8444-444444444444",
+);
+
+function makeLabel(name: string): Label {
+  const label: Label = new Label();
+  label.name = name;
+  return label;
+}
+
+function buildAlert(input: {
+  labels?: Array<Label>;
+  customFields?: JSONObject;
+}): Alert {
+  const alert: Alert = new Alert();
+
+  alert._id = ALERT_ID.toString();
+  alert.id = ALERT_ID;
+  alert.projectId = PROJECT_ID;
+  alert.createdAt = new Date("2026-08-10T10:00:00.000Z");
+
+  const monitor: Monitor = new Monitor();
+  monitor._id = MONITOR_ID.toString();
+  monitor.id = MONITOR_ID;
+  monitor.name = "Checkout API";
+  alert.monitor = monitor;
+
+  const severity: AlertSeverity = new AlertSeverity();
+  severity._id = SEVERITY_ID.toString();
+  severity.id = SEVERITY_ID;
+  severity.name = "Critical";
+  alert.alertSeverity = severity;
+
+  if (input.labels) {
+    alert.labels = input.labels;
+  }
+
+  if (input.customFields) {
+    alert.customFields = input.customFields;
+  }
+
+  return alert;
+}
+
+function buildStateTimeline(input: {
+  startsAt: Date;
+  endsAt?: Date;
+  isAcknowledgedState?: boolean;
+  isResolvedState?: boolean;
+}): AlertStateTimeline {
+  const timeline: AlertStateTimeline = new AlertStateTimeline();
+
+  timeline._id = ObjectID.generate().toString();
+  timeline.id = new ObjectID(timeline._id);
+  timeline.projectId = PROJECT_ID;
+  timeline.alertStateId = ObjectID.generate();
+  timeline.startsAt = input.startsAt;
+
+  if (input.endsAt) {
+    timeline.endsAt = input.endsAt;
+  }
+
+  const state: AlertState = new AlertState();
+  state.isAcknowledgedState = input.isAcknowledgedState || false;
+  state.isResolvedState = input.isResolvedState || false;
+  timeline.alertState = state;
+
+  return timeline;
+}
+
+/** Created -> Acknowledged -> Resolved, so the refresh emits all four metrics. */
+function fullLifecycle(): Array<AlertStateTimeline> {
+  return [
+    buildStateTimeline({
+      startsAt: new Date("2026-08-10T10:00:00.000Z"),
+      endsAt: new Date("2026-08-10T10:05:00.000Z"),
+    }),
+    buildStateTimeline({
+      startsAt: new Date("2026-08-10T10:05:00.000Z"),
+      endsAt: new Date("2026-08-10T10:30:00.000Z"),
+      isAcknowledgedState: true,
+    }),
+    buildStateTimeline({
+      startsAt: new Date("2026-08-10T10:30:00.000Z"),
+      isResolvedState: true,
+    }),
+  ];
+}
+
+describe("Alert metric label and custom field attributes", () => {
+  let savedMetrics: Array<MutableMetric>;
+
+  function mockAlert(input: {
+    labels?: Array<Label>;
+    customFields?: JSONObject;
+  }): void {
+    jest
+      .spyOn(AlertService, "findOneById")
+      .mockResolvedValue(buildAlert(input) as never);
+  }
+
+  beforeEach(() => {
+    savedMetrics = [];
+
+    mockAlert({});
+
+    jest
+      .spyOn(AlertStateTimelineService, "findBy")
+      .mockResolvedValue(fullLifecycle() as never);
+    jest
+      .spyOn(GlobalConfigService, "findOneBy")
+      .mockResolvedValue(null as never);
+    jest.spyOn(Semaphore, "lock").mockResolvedValue({} as never);
+    jest.spyOn(Semaphore, "release").mockResolvedValue(undefined as never);
+    jest
+      .spyOn(TelemetryUtil, "indexMetricNameServiceNameMap")
+      .mockResolvedValue(undefined as never);
+    jest
+      .spyOn(MutableMetricService, "replaceEntityMetrics")
+      .mockImplementation(
+        async (data: { metrics: Array<MutableMetric> }): Promise<void> => {
+          savedMetrics.push(...data.metrics);
+        },
+      );
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function attributesOf(name: AlertMetricType): JSONObject {
+    const metric: MutableMetric | undefined = savedMetrics.find(
+      (candidate: MutableMetric) => {
+        return candidate.name === name;
+      },
+    );
+
+    return (metric?.attributes as JSONObject) || {};
+  }
+
+  test("records a bare label as present and a key:value label as its value", async () => {
+    mockAlert({
+      labels: [makeLabel("customer-facing"), makeLabel("product:X")],
+    });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+
+    const attributes: JSONObject = attributesOf(AlertMetricType.AlertCount);
+
+    expect(attributes["oneuptime.label.product"]).toBe("X");
+    expect(attributes["oneuptime.label.customer_facing"]).toBe("true");
+  });
+
+  test("records custom fields", async () => {
+    mockAlert({
+      customFields: {
+        "Owning Team": "Payments",
+        Escalated: false as never,
+        Squads: ["Payments", "Billing"] as never,
+      },
+    });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+
+    const attributes: JSONObject = attributesOf(AlertMetricType.AlertCount);
+
+    expect(attributes["oneuptime.customField.owning_team"]).toBe("Payments");
+    expect(attributes["oneuptime.customField.escalated"]).toBe("false");
+    expect(attributes["oneuptime.customField.squads"]).toBe(
+      "Payments, Billing",
+    );
+  });
+
+  test("stamps EVERY emitted alert metric, not just the count", async () => {
+    mockAlert({
+      labels: [makeLabel("product:X")],
+      customFields: { Team: "Payments" },
+    });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+
+    const emittedNames: Array<string | undefined> = savedMetrics.map(
+      (metric: MutableMetric) => {
+        return metric.name;
+      },
+    );
+
+    // The refresh really did emit the full family, so the loop below is meaningful.
+    expect(emittedNames).toContain(AlertMetricType.AlertCount);
+    expect(emittedNames).toContain(AlertMetricType.TimeToAcknowledge);
+    expect(emittedNames).toContain(AlertMetricType.TimeToResolve);
+    expect(emittedNames).toContain(AlertMetricType.AlertDuration);
+
+    for (const metric of savedMetrics) {
+      const attributes: JSONObject = metric.attributes as JSONObject;
+      expect(attributes["oneuptime.label.product"]).toBe("X");
+      expect(attributes["oneuptime.customField.team"]).toBe("Payments");
+    }
+  });
+
+  test("keeps every pre-existing alert dimension on every metric", async () => {
+    mockAlert({ labels: [makeLabel("product:X")] });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+
+    for (const metric of savedMetrics) {
+      const attributes: JSONObject = metric.attributes as JSONObject;
+
+      expect(attributes["alertId"]).toBe(ALERT_ID.toString());
+      expect(attributes["projectId"]).toBe(PROJECT_ID.toString());
+      expect(attributes["monitorId"]).toBe(MONITOR_ID.toString());
+      expect(attributes["monitorName"]).toBe("Checkout API");
+      expect(attributes["alertSeverityId"]).toBe(SEVERITY_ID.toString());
+      expect(attributes["alertSeverityName"]).toBe("Critical");
+    }
+  });
+
+  test("publishes the new dimensions in attributeKeys", async () => {
+    mockAlert({
+      labels: [makeLabel("product:X")],
+      customFields: { Team: "Payments" },
+    });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+
+    expect(savedMetrics.length).toBeGreaterThan(0);
+
+    for (const metric of savedMetrics) {
+      expect(metric.attributeKeys).toContain("oneuptime.label.product");
+      expect(metric.attributeKeys).toContain("oneuptime.customField.team");
+      expect(metric.attributeKeys).toEqual(
+        Object.keys(metric.attributes as JSONObject).sort(),
+      );
+    }
+  });
+
+  test("adds no oneuptime.* attributes when the alert has neither", async () => {
+    mockAlert({});
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+
+    expect(savedMetrics.length).toBeGreaterThan(0);
+
+    for (const metric of savedMetrics) {
+      for (const key of Object.keys(metric.attributes as JSONObject)) {
+        expect(key.startsWith("oneuptime.")).toBe(false);
+      }
+    }
+  });
+
+  test("every alert metric carries the identical attribute set", async () => {
+    /*
+     * A dashboard grouped by oneuptime.label.product must not find the
+     * dimension on AlertCount but missing from TimeToResolve.
+     */
+    mockAlert({
+      labels: [makeLabel("product:X"), makeLabel("urgent")],
+      customFields: { Team: "Payments" },
+    });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+
+    const first: JSONObject = savedMetrics[0]?.attributes as JSONObject;
+
+    for (const metric of savedMetrics) {
+      expect(metric.attributes).toEqual(first);
+    }
+  });
+
+  test("produces the same attributes on a repeated refresh", async () => {
+    /*
+     * Alert metrics are mutable — a refresh replaces the previous point.
+     * Attributes that varied between refreshes would churn the series.
+     */
+    mockAlert({
+      labels: [
+        makeLabel("product:web"),
+        makeLabel("Product: api"),
+        makeLabel("urgent"),
+      ],
+      customFields: { Team: "Payments", Tier: 2 as never },
+    });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+    const first: JSONObject = savedMetrics[0]?.attributes as JSONObject;
+
+    savedMetrics = [];
+
+    // Same labels, different row order out of the database.
+    mockAlert({
+      labels: [
+        makeLabel("urgent"),
+        makeLabel("Product: api"),
+        makeLabel("product:web"),
+      ],
+      customFields: { Tier: 2 as never, Team: "Payments" },
+    });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+    const second: JSONObject = savedMetrics[0]?.attributes as JSONObject;
+
+    expect(second).toEqual(first);
+    expect(first["oneuptime.label.product"]).toBe("api, web");
+  });
+
+  test("selects labels and customFields, or the attributes could never be built", async () => {
+    mockAlert({ labels: [makeLabel("product:X")] });
+
+    await AlertService.refreshAlertMetrics({ alertId: ALERT_ID });
+
+    const select: JSONObject = (
+      jest.mocked(AlertService.findOneById).mock.calls[0]?.[0] as unknown as {
+        select: JSONObject;
+      }
+    ).select;
+
+    expect(select["customFields"]).toBe(true);
+    expect(select["labels"]).toEqual({ _id: true, name: true });
+  });
+});

package/Tests/Server/Services/AnalyticsDatabaseService.test.ts

@@ -1,4 +1,6 @@
-import AnalyticsDatabaseService from "../../../Server/Services/AnalyticsDatabaseService";
+import AnalyticsDatabaseService, {
+  MigrationExecuteOptions,
+} from "../../../Server/Services/AnalyticsDatabaseService";
 import {
   SQL,
   Statement,
@@ -930,4 +932,26 @@ describe("AnalyticsDatabaseService", () => {
       });
     });
   });
+
+  describe("MigrationExecuteOptions", () => {
+    /*
+     * Guards the exact regression a customer hit: ON CLUSTER DDL running with
+     * the server-default `throw` output mode aborted the whole migrate Job
+     * with TIMEOUT_EXCEEDED (code 159) when 4 of 5 hosts had a backlogged
+     * DDL queue — even though the queued task completes in the background.
+     */
+    test("migration DDL never throws on distributed DDL confirmation timeout", () => {
+      expect(MigrationExecuteOptions.useMigrationConnection).toBe(true);
+      expect(
+        MigrationExecuteOptions.clickhouseSettings?.distributed_ddl_output_mode,
+      ).toBe("null_status_on_timeout");
+      // Int64 settings travel as strings; default mirrors the server's 180s.
+      expect(
+        String(
+          MigrationExecuteOptions.clickhouseSettings
+            ?.distributed_ddl_task_timeout,
+        ),
+      ).toMatch(/^-?\d+$/);
+    });
+  });
 });