@oneuptime/common 12.0.4 → 12.0.6

package/Tests/Server/Services/DataSourceServiceSettings.test.ts

@@ -0,0 +1,244 @@
+import DataSourceService from "../../../Server/Services/DataSourceService";
+import DataSource from "../../../Models/DatabaseModels/DataSource";
+import DataSourceType from "../../../Types/DataSource/DataSourceType";
+import { DataSourceConnectionSettings } from "../../../Server/Utils/DataSource/Types";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import FindOneByID from "../../../Server/Types/Database/FindOneByID";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+describe("DataSourceService.getConnectionSettingsById", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("returns null for a non-uuid id without querying the database", async () => {
+    const spy: jest.SpiedFunction<typeof DataSourceService.findOneById> = jest
+      .spyOn(DataSourceService, "findOneById")
+      .mockResolvedValue(null);
+
+    const settings: DataSourceConnectionSettings | null =
+      await DataSourceService.getConnectionSettingsById(
+        new ObjectID("not-a-uuid"),
+      );
+
+    expect(settings).toBeNull();
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  test("selects the secret columns with root props (the decrypt path)", async () => {
+    const spy: jest.SpiedFunction<typeof DataSourceService.findOneById> = jest
+      .spyOn(DataSourceService, "findOneById")
+      .mockResolvedValue(null);
+
+    await DataSourceService.getConnectionSettingsById(ObjectID.generate());
+
+    expect(spy).toHaveBeenCalledTimes(1);
+    const callArguments: FindOneByID<DataSource> = spy.mock
+      .calls[0]![0] as FindOneByID<DataSource>;
+
+    expect(callArguments.props.isRoot).toBe(true);
+    expect(callArguments.select!["password"]).toBe(true);
+    expect(callArguments.select!["apiToken"]).toBe(true);
+    expect(callArguments.select!["customHeaders"]).toBe(true);
+    expect(callArguments.select!["dataSourceType"]).toBe(true);
+  });
+
+  test("maps the record into connection settings with parsed headers", async () => {
+    const record: DataSource = {
+      dataSourceType: DataSourceType.Prometheus,
+      url: "https://prometheus.example.com",
+      username: "reader",
+      password: "secret-password",
+      apiToken: "secret-token",
+      customHeaders: { "X-Scope-OrgID": "tenant-1", "X-Num": 42 },
+      additionalOptions: { sslEnabled: true },
+    } as unknown as DataSource;
+
+    jest.spyOn(DataSourceService, "findOneById").mockResolvedValue(record);
+
+    const settings: DataSourceConnectionSettings | null =
+      await DataSourceService.getConnectionSettingsById(ObjectID.generate());
+
+    expect(settings).not.toBeNull();
+    expect(settings!.dataSourceType).toBe(DataSourceType.Prometheus);
+    expect(settings!.url).toBe("https://prometheus.example.com");
+    expect(settings!.password).toBe("secret-password");
+    expect(settings!.apiToken).toBe("secret-token");
+    expect(settings!.customHeaders).toEqual({
+      "X-Scope-OrgID": "tenant-1",
+      "X-Num": "42",
+    });
+    expect(settings!.additionalOptions).toEqual({ sslEnabled: true });
+  });
+
+  test("returns null when the record has no data source type", async () => {
+    jest
+      .spyOn(DataSourceService, "findOneById")
+      .mockResolvedValue({} as unknown as DataSource);
+
+    const settings: DataSourceConnectionSettings | null =
+      await DataSourceService.getConnectionSettingsById(ObjectID.generate());
+
+    expect(settings).toBeNull();
+  });
+});
+
+describe("DataSourceService shape validation", () => {
+  type ValidateShapeFunction = (data: {
+    dataSourceType?: DataSourceType | undefined;
+    url?: string | undefined;
+    databaseHost?: string | undefined;
+  }) => void;
+
+  const validate: ValidateShapeFunction = (data: {
+    dataSourceType?: DataSourceType | undefined;
+    url?: string | undefined;
+    databaseHost?: string | undefined;
+  }): void => {
+    /*
+     * Private method — bracket access is the repo's convention for
+     * pinning private behavior (see DatabaseServiceSanitizeUpdateData).
+     */
+    (DataSourceService as unknown as Record<string, ValidateShapeFunction>)[
+      "validateDataSourceShape"
+    ]!.call(DataSourceService, data);
+  };
+
+  test("accepts an http-based source with a url", () => {
+    expect(() => {
+      validate({
+        dataSourceType: DataSourceType.Prometheus,
+        url: "https://prometheus.example.com",
+      });
+    }).not.toThrow();
+  });
+
+  test("rejects an http-based source without a url", () => {
+    expect(() => {
+      validate({ dataSourceType: DataSourceType.Loki });
+    }).toThrow(BadDataException);
+  });
+
+  test("accepts a database source with a host", () => {
+    expect(() => {
+      validate({
+        dataSourceType: DataSourceType.PostgreSQL,
+        databaseHost: "db.example.com",
+      });
+    }).not.toThrow();
+  });
+
+  test("rejects a database source without a host", () => {
+    expect(() => {
+      validate({ dataSourceType: DataSourceType.ClickHouse });
+    }).toThrow(BadDataException);
+  });
+
+  test("rejects an unknown data source type", () => {
+    expect(() => {
+      validate({
+        dataSourceType: "Not A Real Type" as DataSourceType,
+        url: "https://example.com",
+      });
+    }).toThrow(BadDataException);
+  });
+
+  test("skips validation when the update touches none of the shape fields", () => {
+    expect(() => {
+      validate({});
+    }).not.toThrow();
+  });
+});
+
+describe("DataSourceService.onBeforeUpdate", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  type OnBeforeUpdateFunction = (
+    updateBy: UpdateBy<DataSource>,
+  ) => Promise<unknown>;
+
+  const onBeforeUpdate: OnBeforeUpdateFunction = (
+    updateBy: UpdateBy<DataSource>,
+  ): Promise<unknown> => {
+    /*
+     * Protected method — bracket access is the repo's convention for
+     * pinning non-public behavior (see the shape-validation suite above).
+     */
+    return (
+      DataSourceService as unknown as Record<string, OnBeforeUpdateFunction>
+    )["onBeforeUpdate"]!.call(DataSourceService, updateBy);
+  };
+
+  function makeUpdateBy(data: Record<string, unknown>): UpdateBy<DataSource> {
+    return {
+      query: { _id: ObjectID.generate().toString() },
+      data: data,
+      props: { isRoot: true },
+      limit: 1,
+      skip: 0,
+    } as unknown as UpdateBy<DataSource>;
+  }
+
+  function mockStoredRow(
+    row: Record<string, unknown>,
+  ): jest.SpiedFunction<typeof DataSourceService.findOneBy> {
+    return jest
+      .spyOn(DataSourceService, "findOneBy")
+      .mockResolvedValue(row as unknown as DataSource);
+  }
+
+  test("rejects clearing the url of a stored http source with null", async () => {
+    /*
+     * Presence check, not truthiness: { url: null } must still trigger
+     * validation against the stored row — an HTTP source cannot lose
+     * its URL.
+     */
+    mockStoredRow({
+      dataSourceType: DataSourceType.Prometheus,
+      url: "https://prometheus.example.com",
+    });
+
+    await expect(onBeforeUpdate(makeUpdateBy({ url: null }))).rejects.toThrow(
+      BadDataException,
+    );
+  });
+
+  test("rejects clearing the url with an empty string", async () => {
+    mockStoredRow({
+      dataSourceType: DataSourceType.Prometheus,
+      url: "https://prometheus.example.com",
+    });
+
+    await expect(onBeforeUpdate(makeUpdateBy({ url: "" }))).rejects.toThrow(
+      /require a URL/,
+    );
+  });
+
+  test("does not read the stored row when no shape field is present", async () => {
+    const spy: jest.SpiedFunction<typeof DataSourceService.findOneBy> =
+      mockStoredRow({
+        dataSourceType: DataSourceType.Prometheus,
+        url: "https://prometheus.example.com",
+      });
+
+    await expect(
+      onBeforeUpdate(makeUpdateBy({ description: "x" })),
+    ).resolves.toBeDefined();
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  test("rejects clearing the host of a stored database source with null", async () => {
+    mockStoredRow({
+      dataSourceType: DataSourceType.PostgreSQL,
+      databaseHost: "db.example.com",
+    });
+
+    await expect(
+      onBeforeUpdate(makeUpdateBy({ databaseHost: null })),
+    ).rejects.toThrow(BadDataException);
+  });
+});

package/Tests/Server/Services/DatabaseServicePerUserPasswordSalt.test.ts

@@ -1,13 +1,13 @@
 import UserService from "../../../Server/Services/UserService";
 import StatusPagePrivateUserService from "../../../Server/Services/StatusPagePrivateUserService";
-import DashboardService from "../../../Server/Services/DashboardService";
+import UserSessionService from "../../../Server/Services/UserSessionService";
 import ColumnPermissions from "../../../Server/Types/Database/Permissions/ColumnPermission";
 import DatabaseRequestType from "../../../Server/Types/BaseDatabase/DatabaseRequestType";
 import PasswordHash from "../../../Server/Utils/PasswordHash";
 import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
 import User from "../../../Models/DatabaseModels/User";
 import StatusPagePrivateUser from "../../../Models/DatabaseModels/StatusPagePrivateUser";
-import Dashboard from "../../../Models/DatabaseModels/Dashboard";
+import UserSession from "../../../Models/DatabaseModels/UserSession";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { TableColumnMetadata } from "../../../Types/Database/TableColumn";
 import TableColumnType from "../../../Types/Database/TableColumnType";
@@ -33,8 +33,8 @@ import { afterEach, describe, expect, jest, test } from "@jest/globals";
  *   - a salt column that forgets `computed: true` breaks every non-root
  *     create of a row carrying a password, because the create permission
  *     check runs AFTER hashing and would reject a column nobody may write;
- *   - a hashed column with no declared salt column (session refresh tokens,
- *     master passwords) must keep hashing exactly as it always did;
+ *   - a hashed column with no declared salt column (session refresh tokens)
+ *     must keep hashing exactly as it always did;
  *   - an update that does not touch the password must not touch the salt,
  *     or every password in the affected rows stops verifying.
  *
@@ -355,56 +355,57 @@ describe("Update path — sanitizeCreateOrUpdate mints a per-record salt", () =>
   });
 });
 
-describe("Hashed columns that declare no salt column are untouched", () => {
-  test("a dashboard master password still uses the legacy unsalted digest", async () => {
-    /*
-     * Dashboard.masterPassword is `hashed: true` with no hashSaltColumn — a
-     * shared secret, not a per-user credential. Every master password
-     * already stored has to keep verifying, so this digest must not move.
-     */
-    const dashboard: Dashboard = new Dashboard();
-    dashboard.masterPassword = new HashedString("master-password");
-
-    await (
-      DashboardService as unknown as { hash: HashFunction<Dashboard> }
-    ).hash(dashboard);
+describe("High-entropy hashed columns remain searchable", () => {
+  test("a session refresh token keeps the fast deterministic SHA-256 digest", async () => {
+    const data: JSONObject = (await (
+      UserSessionService as unknown as {
+        sanitizeCreateOrUpdate: SanitizeFunction;
+      }
+    ).sanitizeCreateOrUpdate(
+      {
+        refreshToken: new HashedString("server-generated-refresh-token"),
+      },
+      { isRoot: true },
+    )) as JSONObject;
 
-    expect(dashboard.masterPassword!.toString()).toBe(
+    expect(data["refreshToken"]).toBe(
       CryptoJS.SHA256(
-        EncryptionSecret.toString() + "master-password",
+        EncryptionSecret.toString() + "server-generated-refresh-token",
       ).toString(),
     );
   });
 
-  test("no stray salt column is invented for it", async () => {
-    const dashboard: Dashboard = new Dashboard();
-    dashboard.masterPassword = new HashedString("master-password");
-
-    await (
-      DashboardService as unknown as { hash: HashFunction<Dashboard> }
-    ).hash(dashboard);
+  test("refresh tokens do not declare or invent a password salt", async () => {
+    const data: JSONObject = (await (
+      UserSessionService as unknown as {
+        sanitizeCreateOrUpdate: SanitizeFunction;
+      }
+    ).sanitizeCreateOrUpdate(
+      {
+        refreshToken: new HashedString("server-generated-refresh-token"),
+      },
+      { isRoot: true },
+    )) as JSONObject;
 
     expect(
-      new Dashboard().getTableColumnMetadata("masterPassword").hashSaltColumn,
-    ).toBeUndefined();
-    expect(
-      (dashboard as unknown as JSONObject)["passwordSalt"],
+      new UserSession().getTableColumnMetadata("refreshToken").hashSaltColumn,
     ).toBeUndefined();
+    expect(data["refreshTokenSalt"]).toBeUndefined();
   });
 
-  test("a bare string is still allowed on an unsalted hashed column", async () => {
-    // The desync guard is scoped to salted columns only.
+  test("a pre-hashed refresh-token digest remains accepted on update", async () => {
     const data: JSONObject = (await (
-      DashboardService as unknown as {
+      UserSessionService as unknown as {
         sanitizeCreateOrUpdate: SanitizeFunction;
       }
     ).sanitizeCreateOrUpdate(
-      { masterPassword: "a-raw-digest" },
+      { refreshToken: "a-raw-digest" },
       { isRoot: true },
       true,
     )) as JSONObject;
 
-    expect(data["masterPassword"]).toBe("a-raw-digest");
+    expect(data["refreshToken"]).toBe("a-raw-digest");
+    expect(data["refreshTokenSalt"]).toBeUndefined();
   });
 });
 
@@ -415,6 +416,7 @@ describe("Hashed columns that declare no salt column are untouched", () => {
 type UpdateColumnsInput = {
   id: ObjectID;
   data: JSONObject;
+  expectedData?: JSONObject;
   skipUpdateDateColumn?: boolean;
 };
 
@@ -597,6 +599,10 @@ describe("verifyHashedColumnValue — transparent upgrade of legacy hashes", ()
 
     expect(write.id.toString()).toBe(user._id);
     expect(write.data["passwordSalt"]).toMatch(/^[0-9a-f]{64}$/);
+    expect(write.expectedData).toEqual({
+      password: user.password!.toString(),
+      passwordSalt: null,
+    });
 
     // The written hash verifies under the written salt.
     await expect(
@@ -726,6 +732,10 @@ describe("verifyHashedColumnValue — transparent upgrade of legacy hashes", ()
 
     expect(captured).toHaveLength(1);
     expect(captured[0]!.data["password"]).toMatch(/^scrypt\$/);
+    expect(captured[0]!.expectedData).toEqual({
+      password: user.password!.toString(),
+      passwordSalt: salt,
+    });
     // A brand new salt, not the interim one it came in with.
     expect(captured[0]!.data["passwordSalt"]).not.toBe(salt);
   });

package/Tests/Server/Services/DatabaseServiceUpdateColumnsWithoutHooks.test.ts

@@ -125,4 +125,58 @@ describe("DatabaseService.updateColumnsByIdWithoutHooks", () => {
       APPLICATION_ID.toString(),
     );
   });
+
+  it("adds null-safe compare-and-set guards for expected values", async () => {
+    const newValue: Date = new Date("2026-08-07T10:00:00.000Z");
+    const oldValue: Date = new Date("2026-08-07T09:00:00.000Z");
+
+    await service.updateColumnsByIdWithoutHooks({
+      id: APPLICATION_ID,
+      data: { lastSeenAt: newValue },
+      expectedData: {
+        sessionReplayLastChunkReceivedAt: oldValue,
+        sessionReplayBudgetExceededAt: null,
+      },
+      skipUpdateDateColumn: true,
+    });
+
+    expect(captured).toEqual([
+      {
+        sql:
+          `UPDATE "RumApplication" SET "lastSeenAt" = $1 ` +
+          `WHERE "_id" = $2 ` +
+          `AND "sessionReplayLastChunkReceivedAt" IS NOT DISTINCT FROM $3 ` +
+          `AND "sessionReplayBudgetExceededAt" IS NOT DISTINCT FROM $4`,
+        params: [newValue, APPLICATION_ID.toString(), oldValue, null],
+      },
+    ]);
+  });
+
+  it("rejects unknown compare-and-set columns before issuing SQL", async () => {
+    await expect(
+      service.updateColumnsByIdWithoutHooks({
+        id: APPLICATION_ID,
+        data: { lastSeenAt: new Date() },
+        expectedData: { notAColumn: "value" } as never,
+      }),
+    ).rejects.toThrow('unknown expected column "notAColumn"');
+
+    expect(captured).toHaveLength(0);
+  });
+
+  it("rejects SQL expressions in compare-and-set values", async () => {
+    await expect(
+      service.updateColumnsByIdWithoutHooks({
+        id: APPLICATION_ID,
+        data: { lastSeenAt: new Date() },
+        expectedData: {
+          sessionReplayLastChunkReceivedAt: (() => {
+            return "NOW()";
+          }) as never,
+        },
+      }),
+    ).rejects.toThrow("SQL-expression expected values are not supported");
+
+    expect(captured).toHaveLength(0);
+  });
 });

package/Tests/Server/Services/FeedAIRunAssociation.test.ts

@@ -0,0 +1,125 @@
+import AlertFeed, {
+  AlertFeedEventType,
+} from "../../../Models/DatabaseModels/AlertFeed";
+import IncidentFeed, {
+  IncidentFeedEventType,
+} from "../../../Models/DatabaseModels/IncidentFeed";
+import AlertFeedService from "../../../Server/Services/AlertFeedService";
+import IncidentFeedService from "../../../Server/Services/IncidentFeedService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import type { TableColumnMetadata } from "../../../Types/Database/TableColumn";
+import TableColumnType from "../../../Types/Database/TableColumnType";
+import ObjectID from "../../../Types/ObjectID";
+import { afterEach, describe, expect, it, jest } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import type { ColumnMetadataArgs } from "typeorm/metadata-args/ColumnMetadataArgs";
+import type { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+);
+const INCIDENT_ID: ObjectID = new ObjectID(
+  "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+);
+const ALERT_ID: ObjectID = new ObjectID("cccccccc-cccc-4ccc-8ccc-cccccccccccc");
+const AI_RUN_ID: ObjectID = new ObjectID(
+  "dddddddd-dddd-4ddd-8ddd-dddddddddddd",
+);
+
+function expectRunAssociationMetadata(
+  model: IncidentFeed | AlertFeed,
+  target: typeof IncidentFeed | typeof AlertFeed,
+  subjectIdColumn: "incidentId" | "alertId",
+): void {
+  expect(model.getTableColumns().columns).toContain("aiRunId");
+
+  const tableColumn: TableColumnMetadata =
+    model.getTableColumnMetadata("aiRunId");
+  expect(tableColumn.type).toBe(TableColumnType.ObjectID);
+  expect(tableColumn.required).toBe(false);
+  expect(tableColumn.canReadOnRelationQuery).toBe(true);
+
+  const databaseColumn: ColumnMetadataArgs | undefined =
+    getMetadataArgsStorage().columns.find((column: ColumnMetadataArgs) => {
+      return column.target === target && column.propertyName === "aiRunId";
+    });
+  expect(databaseColumn?.options.nullable).toBe(true);
+
+  const hasExactLookupIndex: boolean = getMetadataArgsStorage().indices.some(
+    (index: IndexMetadataArgs): boolean => {
+      return (
+        index.target === target &&
+        Array.isArray(index.columns) &&
+        index.columns.length === 2 &&
+        index.columns[0] === subjectIdColumn &&
+        index.columns[1] === "aiRunId"
+      );
+    },
+  );
+  expect(hasExactLookupIndex).toBe(true);
+}
+
+describe("feed AI run association metadata", () => {
+  it("defines a nullable, exact-lookup-indexed incident feed association", () => {
+    expectRunAssociationMetadata(
+      new IncidentFeed(),
+      IncidentFeed,
+      "incidentId",
+    );
+  });
+
+  it("defines a nullable, exact-lookup-indexed alert feed association", () => {
+    expectRunAssociationMetadata(new AlertFeed(), AlertFeed, "alertId");
+  });
+});
+
+describe("feed service AI run persistence", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("copies aiRunId into the incident RootCause row", async () => {
+    jest
+      .spyOn(IncidentFeedService, "create")
+      .mockResolvedValue(new IncidentFeed());
+
+    await IncidentFeedService.createIncidentFeedItem({
+      incidentId: INCIDENT_ID,
+      projectId: PROJECT_ID,
+      aiRunId: AI_RUN_ID,
+      incidentFeedEventType: IncidentFeedEventType.RootCause,
+      feedInfoInMarkdown: "Incident analysis",
+    });
+
+    const createCall: CreateBy<IncidentFeed> = jest.mocked(
+      IncidentFeedService.create,
+    ).mock.calls[0]![0];
+    const createData: IncidentFeed = createCall.data;
+    expect(createData.aiRunId).toEqual(AI_RUN_ID);
+    expect(createData.incidentId).toEqual(INCIDENT_ID);
+    expect(createData.incidentFeedEventType).toBe(
+      IncidentFeedEventType.RootCause,
+    );
+    expect(createCall.props).toEqual({ isRoot: true });
+  });
+
+  it("copies aiRunId into the alert RootCause row", async () => {
+    jest.spyOn(AlertFeedService, "create").mockResolvedValue(new AlertFeed());
+
+    await AlertFeedService.createAlertFeedItem({
+      alertId: ALERT_ID,
+      projectId: PROJECT_ID,
+      aiRunId: AI_RUN_ID,
+      alertFeedEventType: AlertFeedEventType.RootCause,
+      feedInfoInMarkdown: "Alert analysis",
+    });
+
+    const createCall: CreateBy<AlertFeed> = jest.mocked(AlertFeedService.create)
+      .mock.calls[0]![0];
+    const createData: AlertFeed = createCall.data;
+    expect(createData.aiRunId).toEqual(AI_RUN_ID);
+    expect(createData.alertId).toEqual(ALERT_ID);
+    expect(createData.alertFeedEventType).toBe(AlertFeedEventType.RootCause);
+    expect(createCall.props).toEqual({ isRoot: true });
+  });
+});