@oneuptime/common 12.0.4 → 12.0.6

package/Tests/Server/Types/Database/ObjectIdColumnQuery.test.ts

@@ -0,0 +1,262 @@
+import QueryPermission from "../../../../Server/Types/Database/Permissions/QueryPermission";
+import QueryUtil from "../../../../Server/Types/Database/QueryUtil";
+import Project from "../../../../Models/DatabaseModels/Project";
+import User from "../../../../Models/DatabaseModels/User";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import EqualTo from "../../../../Types/BaseDatabase/EqualTo";
+import NotEqual from "../../../../Types/BaseDatabase/NotEqual";
+import Search from "../../../../Types/BaseDatabase/Search";
+import StartsWith from "../../../../Types/BaseDatabase/StartsWith";
+import ObjectID from "../../../../Types/ObjectID";
+import { DatabaseBaseModelType } from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { FindOperator } from "typeorm";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * The server half of "filter users and projects by ID" in the admin
+ * dashboard.
+ *
+ * `_id` is not an ordinary text column - it is a Postgres `uuid`, and uuid has
+ * no ILIKE. A partial-match filter on it only works because QueryHelper.search
+ * wraps the column in `CAST(... AS TEXT)` first; emit the ILIKE against the
+ * raw column and Postgres rejects the whole statement with
+ * `operator does not exist: uuid ~~* unknown`. That cast is invisible from the
+ * UI - the filter looks identical either way and simply errors at fetch time -
+ * so it is asserted here rather than inferred.
+ *
+ * The other half is the permission layer: every queried column is checked
+ * against what the caller may read, and a column it does not recognise is
+ * rejected outright. `_id` passes as an always-readable column, which is what
+ * lets the filter reach the database at all.
+ */
+
+const A_UUID: string = "5f0e8e3a-1f24-4a2f-9e4c-2b1d3c4e5f60";
+
+type SerializeFunction = (
+  modelType: DatabaseBaseModelType,
+  query: Record<string, unknown>,
+) => Record<string, any>;
+
+const serialize: SerializeFunction = (
+  modelType: DatabaseBaseModelType,
+  query: Record<string, unknown>,
+): Record<string, any> => {
+  return QueryUtil.serializeQuery(modelType, query as any) as unknown as Record<
+    string,
+    any
+  >;
+};
+
+type RawSqlFunction = (operator: unknown, aliasPath: string) => string;
+
+const rawSql: RawSqlFunction = (
+  operator: unknown,
+  aliasPath: string,
+): string => {
+  const getSql: ((aliasPath: string) => string) | undefined = (
+    operator as FindOperator<unknown>
+  ).getSql;
+
+  if (!getSql) {
+    throw new Error("Expected a Raw FindOperator with a SQL generator.");
+  }
+
+  return getSql(aliasPath);
+};
+
+type ParamsFunction = (operator: unknown) => Array<unknown>;
+
+const params: ParamsFunction = (operator: unknown): Array<unknown> => {
+  return Object.values(
+    (
+      operator as unknown as {
+        objectLiteralParameters: Record<string, unknown>;
+      }
+    ).objectLiteralParameters,
+  );
+};
+
+describe("QueryUtil.serializeQuery — filtering on the _id column", () => {
+  describe("User", () => {
+    /*
+     * The default operator in the ID filter. A Search that reached TypeORM
+     * un-serialized would silently degrade into an exact equality, so pasting
+     * a fragment of an id would quietly match nothing at all.
+     */
+    it("turns a partial-id Search into an ILIKE over the id cast to text", () => {
+      const result: Record<string, any> = serialize(User, {
+        _id: new Search("5f0e8e3a"),
+      });
+
+      expect(result["_id"]).toBeInstanceOf(FindOperator);
+      expect(result["_id"]).not.toBeInstanceOf(Search);
+      expect(result["_id"].type).toBe("raw");
+
+      const sql: string = rawSql(result["_id"], "User._id");
+
+      // Without the cast this is invalid SQL against a uuid column.
+      expect(sql).toContain("CAST(User._id AS TEXT)");
+      expect(sql).toContain("ILIKE");
+      expect(params(result["_id"])).toEqual(["%5f0e8e3a%"]);
+    });
+
+    it("turns a whole-id EqualTo into a plain equality", () => {
+      const result: Record<string, any> = serialize(User, {
+        _id: new EqualTo(A_UUID),
+      });
+
+      expect(result["_id"].type).toBe("raw");
+      expect(rawSql(result["_id"], "User._id")).toContain("User._id = :");
+      expect(params(result["_id"])).toEqual([A_UUID]);
+    });
+
+    it("turns a NotEqual into an inequality", () => {
+      const result: Record<string, any> = serialize(User, {
+        _id: new NotEqual(A_UUID),
+      });
+
+      expect(rawSql(result["_id"], "User._id")).toContain("User._id != :");
+      expect(params(result["_id"])).toEqual([A_UUID]);
+    });
+
+    /*
+     * Prefix matching is the operator an admin reaches for with a truncated
+     * id, so it needs the same cast as `contains` - and an anchored pattern,
+     * not a floating one.
+     */
+    it("anchors a StartsWith to the front of the id", () => {
+      const result: Record<string, any> = serialize(User, {
+        _id: new StartsWith("5f0e8e3a"),
+      });
+
+      expect(rawSql(result["_id"], "User._id")).toContain(
+        "CAST(User._id AS TEXT)",
+      );
+      expect(params(result["_id"])).toEqual(["5f0e8e3a%"]);
+    });
+
+    /*
+     * Ids are copied out of the UI with whatever case the source used, and
+     * ILIKE is case-insensitive anyway - but the bound parameter has to be
+     * lower-cased consistently or a mixed-case paste behaves differently from
+     * the same id typed in lower case.
+     */
+    it("matches an id regardless of the case it was pasted in", () => {
+      expect(
+        params(
+          serialize(User, { _id: new Search(A_UUID.toUpperCase()) })["_id"],
+        ),
+      ).toEqual([`%${A_UUID}%`]);
+    });
+
+    it("leaves a bare id string as a plain equality value", () => {
+      expect(serialize(User, { _id: A_UUID })["_id"]).toBe(A_UUID);
+    });
+
+    it("unwraps an ObjectID into an equality on the id", () => {
+      const result: Record<string, any> = serialize(User, {
+        _id: new ObjectID(A_UUID),
+      });
+
+      expect(result["_id"].type).toBe("raw");
+      expect(params(result["_id"])).toEqual([A_UUID]);
+    });
+  });
+
+  /*
+   * Project is a different model with a different column set, and the admin
+   * dashboard filters it the same way. Nothing about the _id handling is
+   * per-model, and this is what says so.
+   */
+  describe("Project", () => {
+    it("turns a partial-id Search into an ILIKE over the id cast to text", () => {
+      const result: Record<string, any> = serialize(Project, {
+        _id: new Search("5f0e8e3a"),
+      });
+
+      expect(result["_id"].type).toBe("raw");
+      expect(rawSql(result["_id"], "Project._id")).toContain(
+        "CAST(Project._id AS TEXT)",
+      );
+      expect(params(result["_id"])).toEqual(["%5f0e8e3a%"]);
+    });
+
+    it("turns a whole-id EqualTo into a plain equality", () => {
+      const result: Record<string, any> = serialize(Project, {
+        _id: new EqualTo(A_UUID),
+      });
+
+      expect(rawSql(result["_id"], "Project._id")).toContain("Project._id = :");
+      expect(params(result["_id"])).toEqual([A_UUID]);
+    });
+  });
+});
+
+/*
+ * `checkQueryPermission` walks every key of the incoming query and rejects
+ * anything the caller cannot read. An id filter arrives as a query key like
+ * any other, so it has to survive that walk.
+ */
+describe("QueryPermission.checkQueryPermission — querying by _id", () => {
+  /*
+   * No permissions at all: the weakest caller there is. `_id` is one of the
+   * always-readable columns, so even this caller may filter on it - which is
+   * what keeps the ID filter working for every table that offers one, without
+   * a per-model permission grant.
+   */
+  const noPermissions: DatabaseCommonInteractionProps = {
+    userGlobalAccessPermission: {
+      projectIds: [],
+      globalPermissions: [],
+      _type: "UserGlobalAccessPermission",
+    },
+  } as unknown as DatabaseCommonInteractionProps;
+
+  it("allows filtering users by _id", () => {
+    expect(() => {
+      QueryPermission.checkQueryPermission<User>(
+        User,
+        { _id: new Search("5f0e8e3a") } as any,
+        noPermissions,
+      );
+    }).not.toThrow();
+  });
+
+  it("allows filtering projects by _id", () => {
+    expect(() => {
+      QueryPermission.checkQueryPermission<Project>(
+        Project,
+        { _id: new Search("5f0e8e3a") } as any,
+        noPermissions,
+      );
+    }).not.toThrow();
+  });
+
+  /*
+   * The counter-case. Without it the two tests above would pass just as well
+   * against a permission check that waves everything through.
+   */
+  it("still rejects a column that does not exist", () => {
+    expect(() => {
+      QueryPermission.checkQueryPermission<User>(
+        User,
+        { notAColumn: new Search("x") } as any,
+        noPermissions,
+      );
+    }).toThrow(/Invalid column on User/);
+  });
+
+  /*
+   * ...and a real column that this caller has no permission to read, which is
+   * the check `_id` is deliberately exempt from.
+   */
+  it("still rejects a real column the caller cannot read", () => {
+    expect(() => {
+      QueryPermission.checkQueryPermission<User>(
+        User,
+        { isMasterAdmin: true } as any,
+        noPermissions,
+      );
+    }).toThrow();
+  });
+});

package/Tests/Server/Types/Database/Permissions/TenantPermission.test.ts

@@ -0,0 +1,358 @@
+import User from "../../../../../Models/DatabaseModels/User";
+import UserOnCallLog from "../../../../../Models/DatabaseModels/UserOnCallLog";
+import UserOnCallLogTimeline from "../../../../../Models/DatabaseModels/UserOnCallLogTimeline";
+import UserSession from "../../../../../Models/DatabaseModels/UserSession";
+import UserTotpAuth from "../../../../../Models/DatabaseModels/UserTotpAuth";
+import UserWebAuthn from "../../../../../Models/DatabaseModels/UserWebAuthn";
+import BaseModel from "../../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import UserService from "../../../../../Server/Services/UserService";
+import DatabaseRequestType from "../../../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import DeleteBy from "../../../../../Server/Types/Database/DeleteBy";
+import BasePermission from "../../../../../Server/Types/Database/Permissions/BasePermission";
+import TenantPermission from "../../../../../Server/Types/Database/Permissions/TenantPermission";
+import Query from "../../../../../Server/Types/Database/Query";
+import UpdateBy from "../../../../../Server/Types/Database/UpdateBy";
+import NotEqual from "../../../../../Types/BaseDatabase/NotEqual";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ColumnAccessControl from "../../../../../Types/Database/AccessControl/ColumnAccessControl";
+import TableAccessControl from "../../../../../Types/Database/AccessControl/TableAccessControl";
+import CurrentUserCanAccessRecordBy from "../../../../../Types/Database/CurrentUserCanAccessRecordBy";
+import TableColumn from "../../../../../Types/Database/TableColumn";
+import TableColumnType from "../../../../../Types/Database/TableColumnType";
+import TenantColumn from "../../../../../Types/Database/TenantColumn";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission from "../../../../../Types/Permission";
+import UserType from "../../../../../Types/UserType";
+
+@TableAccessControl({
+  create: [Permission.CurrentUser],
+  read: [Permission.CurrentUser],
+  update: [Permission.CurrentUser],
+  delete: [Permission.CurrentUser],
+})
+@CurrentUserCanAccessRecordBy("userId")
+class MisconfiguredCurrentUserModel extends BaseModel {}
+
+@TableAccessControl({
+  create: [Permission.CurrentUser],
+  read: [Permission.CurrentUser],
+  update: [Permission.CurrentUser],
+  delete: [Permission.CurrentUser],
+})
+class MissingCurrentUserScopeModel extends BaseModel {}
+
+@TableAccessControl({
+  create: [Permission.CurrentUser],
+  read: [Permission.CurrentUser, Permission.ProjectAdmin],
+  update: [Permission.CurrentUser],
+  delete: [Permission.CurrentUser],
+})
+@CurrentUserCanAccessRecordBy("userId")
+@TenantColumn("projectId")
+class TenantScopedCurrentUserModel extends BaseModel {
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser, Permission.ProjectAdmin],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Project ID",
+  })
+  public projectId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser, Permission.ProjectAdmin],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "User ID",
+  })
+  public userId?: ObjectID = undefined;
+}
+
+describe("TenantPermission current-user ownership scope", () => {
+  const userId: ObjectID = ObjectID.generate();
+  const victimUserId: ObjectID = ObjectID.generate();
+
+  function makeUserProps(): DatabaseCommonInteractionProps {
+    return {
+      userId,
+    };
+  }
+
+  it.each([UserTotpAuth, UserWebAuthn, UserSession])(
+    "scopes %p queries to the authenticated user's records",
+    async (modelType: { new (): BaseModel }) => {
+      for (const requestType of [
+        DatabaseRequestType.Read,
+        DatabaseRequestType.Update,
+        DatabaseRequestType.Delete,
+      ]) {
+        const query: Query<BaseModel> =
+          await TenantPermission.addTenantScopeToQuery(
+            modelType,
+            {},
+            null,
+            makeUserProps(),
+            requestType,
+          );
+
+        expect((query as any).userId?.toString()).toBe(userId.toString());
+      }
+    },
+  );
+
+  it.each([UserTotpAuth, UserWebAuthn, UserSession])(
+    "rejects %p operations that explicitly target another user",
+    async (modelType: { new (): BaseModel }) => {
+      for (const requestType of [
+        DatabaseRequestType.Read,
+        DatabaseRequestType.Update,
+        DatabaseRequestType.Delete,
+      ]) {
+        await expect(
+          TenantPermission.addTenantScopeToQuery(
+            modelType,
+            { userId: victimUserId } as any,
+            null,
+            makeUserProps(),
+            requestType,
+          ),
+        ).rejects.toThrow(NotAuthorizedException);
+      }
+    },
+  );
+
+  it("rejects CurrentUser access when a non-user caller has no user identity", async () => {
+    const apiKeyProps: DatabaseCommonInteractionProps = {
+      userType: UserType.API,
+      userGlobalAccessPermission: {
+        projectIds: [ObjectID.generate()],
+        globalPermissions: [
+          Permission.Public,
+          Permission.User,
+          Permission.CurrentUser,
+        ],
+        _type: "UserGlobalAccessPermission",
+      },
+    };
+
+    await expect(
+      BasePermission.checkPermissions(
+        UserTotpAuth,
+        {},
+        null,
+        apiKeyProps,
+        DatabaseRequestType.Read,
+      ),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+
+  it("fails closed when a CurrentUser model resolves no ownership filter", async () => {
+    await expect(
+      TenantPermission.addTenantScopeToQuery(
+        MisconfiguredCurrentUserModel,
+        {},
+        null,
+        makeUserProps(),
+        DatabaseRequestType.Read,
+      ),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+
+  it("fails closed when CurrentUser ownership metadata is missing", async () => {
+    await expect(
+      TenantPermission.addTenantScopeToQuery(
+        MissingCurrentUserScopeModel,
+        {},
+        null,
+        makeUserProps(),
+        DatabaseRequestType.Read,
+      ),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+
+  it("keeps User reads scoped to the authenticated user's primary key", async () => {
+    const query: Query<User> = await TenantPermission.addTenantScopeToQuery(
+      User,
+      {},
+      null,
+      makeUserProps(),
+      DatabaseRequestType.Read,
+    );
+
+    expect((query as any)._id?.toString()).toBe(userId.toString());
+  });
+
+  it("rejects query operators that disguise a broad ownership filter", async () => {
+    await expect(
+      TenantPermission.addTenantScopeToQuery(
+        User,
+        { _id: new NotEqual<string>(userId.toString()) },
+        null,
+        makeUserProps(),
+        DatabaseRequestType.Update,
+      ),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+
+  it("rejects deleting another User instead of redirecting the delete", async () => {
+    await expect(
+      TenantPermission.addTenantScopeToQuery(
+        User,
+        { _id: victimUserId },
+        null,
+        makeUserProps(),
+        DatabaseRequestType.Delete,
+      ),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+
+  it("allows deleting the authenticated User's own record", async () => {
+    const deleteQuery: Query<User> =
+      await TenantPermission.addTenantScopeToQuery(
+        User,
+        { _id: userId },
+        null,
+        makeUserProps(),
+        DatabaseRequestType.Delete,
+      );
+
+    expect((deleteQuery as any)._id?.toString()).toBe(userId.toString());
+  });
+
+  it.each([UserOnCallLog, UserOnCallLogTimeline])(
+    "scopes %p reads to the current user within the tenant",
+    async (modelType: { new (): BaseModel }) => {
+      const projectId: ObjectID = ObjectID.generate();
+      const query: Query<BaseModel> =
+        await TenantPermission.addTenantScopeToQuery(
+          modelType,
+          {},
+          null,
+          { ...makeUserProps(), tenantId: projectId },
+          DatabaseRequestType.Read,
+        );
+
+      expect((query as any).projectId?.toString()).toBe(projectId.toString());
+      expect((query as any).userId?.toString()).toBe(userId.toString());
+    },
+  );
+
+  it("does not mutate a query reused for list and count permission checks", async () => {
+    const reusedQuery: Query<UserTotpAuth> = {};
+
+    await BasePermission.checkPermissions(
+      UserTotpAuth,
+      reusedQuery,
+      null,
+      makeUserProps(),
+      DatabaseRequestType.Read,
+    );
+    await expect(
+      BasePermission.checkPermissions(
+        UserTotpAuth,
+        reusedQuery,
+        null,
+        makeUserProps(),
+        DatabaseRequestType.Read,
+      ),
+    ).resolves.toBeDefined();
+
+    expect(reusedQuery).toEqual({});
+  });
+
+  it("isolates CurrentUser scope for every project in a multi-tenant query", async () => {
+    const currentUserProjectId: ObjectID = ObjectID.generate();
+    const adminProjectId: ObjectID = ObjectID.generate();
+
+    for (const projectIds of [
+      [currentUserProjectId, adminProjectId],
+      [adminProjectId, currentUserProjectId],
+    ]) {
+      const queries: Array<Record<string, unknown>> =
+        (await TenantPermission.addTenantScopeToQuery(
+          TenantScopedCurrentUserModel,
+          {},
+          null,
+          {
+            userId,
+            userGlobalAccessPermission: {
+              projectIds,
+              globalPermissions: [Permission.Public, Permission.CurrentUser],
+              _type: "UserGlobalAccessPermission",
+            },
+            userTenantAccessPermission: {
+              [adminProjectId.toString()]: {
+                projectId: adminProjectId,
+                permissions: [
+                  {
+                    permission: Permission.ProjectAdmin,
+                    labelIds: [],
+                    isBlockPermission: false,
+                    _type: "UserPermission",
+                  },
+                ],
+                _type: "UserTenantAccessPermission",
+              },
+            },
+          },
+          DatabaseRequestType.Read,
+        )) as unknown as Array<Record<string, unknown>>;
+
+      expect(queries).toHaveLength(2);
+      expect(
+        queries[projectIds.indexOf(currentUserProjectId)]?.["userId"],
+      ).toBeDefined();
+      expect(
+        queries[projectIds.indexOf(adminProjectId)]?.["userId"],
+      ).toBeUndefined();
+    }
+  });
+
+  it("rejects a cross-user delete before UserService inspects memberships", async () => {
+    await expect(
+      (UserService as any).onBeforeDelete({
+        query: { _id: victimUserId },
+        props: makeUserProps(),
+        limit: 1,
+        skip: 0,
+      } as DeleteBy<User>),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+
+  it("rejects broad update operators before UserService runs user hooks", async () => {
+    await expect(
+      (UserService as any).onBeforeUpdate({
+        query: { _id: new NotEqual<string>(userId.toString()) },
+        data: { password: "new-password" },
+        props: makeUserProps(),
+        limit: 1,
+        skip: 0,
+      } as unknown as UpdateBy<User>),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+});
+
+describe("two-factor credential ownership columns", () => {
+  it("prevents TOTP ownership and verification from being changed via CRUD", () => {
+    const model: UserTotpAuth = new UserTotpAuth();
+
+    expect(model.getColumnAccessControlFor("user")?.update).toEqual([]);
+    expect(model.getColumnAccessControlFor("user")?.create).toEqual([]);
+    expect(model.getColumnAccessControlFor("userId")?.update).toEqual([]);
+    expect(model.getColumnAccessControlFor("isVerified")?.update).toEqual([]);
+  });
+
+  it("prevents WebAuthn ownership from being changed via CRUD", () => {
+    const model: UserWebAuthn = new UserWebAuthn();
+
+    expect(model.getColumnAccessControlFor("user")?.update).toEqual([]);
+    expect(model.getColumnAccessControlFor("user")?.create).toEqual([]);
+    expect(model.getColumnAccessControlFor("userId")?.update).toEqual([]);
+  });
+});

package/Tests/Server/Utils/AI/AIAlertGating.test.ts

@@ -6,6 +6,7 @@ import AlertService from "../../../../Server/Services/AlertService";
 import AlertSeverityService from "../../../../Server/Services/AlertSeverityService";
 import ProjectService from "../../../../Server/Services/ProjectService";
 import AIRunService from "../../../../Server/Services/AIRunService";
+import QueryHelper from "../../../../Server/Types/Database/QueryHelper";
 import Alert from "../../../../Models/DatabaseModels/Alert";
 import AlertSeverity from "../../../../Models/DatabaseModels/AlertSeverity";
 import Project from "../../../../Models/DatabaseModels/Project";
@@ -20,7 +21,7 @@ import { describe, expect, test, afterEach } from "@jest/globals";
  *     severity);
  *   - per-monitor dedupe window: a monitor already investigated within the
  *     window is not re-investigated;
- *   - per-project concurrency cap in the shared engine.
+ *   - an alert-specific concurrency cap in the shared engine.
  *
  * These tests mock the persistence layer (no Postgres) to lock in the gate
  * decisions and their fail directions: unknown severity PASSES the severity
@@ -217,6 +218,36 @@ describe("AIAlertInvestigationRunner.shouldInvestigateAlert", () => {
     );
   });
 
+  test("the cooldown counts alert investigations only, so incident runs cannot suppress an alert", async () => {
+    const monitorId: ObjectID = ObjectID.generate();
+    const alertSubjectFilter: Record<string, string> = {
+      operator: "alert-not-null",
+    };
+    const incidentSubjectFilter: Record<string, string> = {
+      operator: "incident-null",
+    };
+    jest.spyOn(QueryHelper, "notNull").mockReturnValue(alertSubjectFilter);
+    jest.spyOn(QueryHelper, "isNull").mockReturnValue(incidentSubjectFilter);
+    const countBy: jest.SpyInstance = jest.spyOn(AIRunService, "countBy");
+
+    mockGates({
+      alert: fakeAlert({ severityOrder: 1, monitorId }),
+      topTiers: fakeSeverities([1, 2]),
+      recentRunCount: 0,
+    });
+
+    await AIAlertInvestigationRunner.shouldInvestigateAlert({
+      alertId,
+      projectId,
+    });
+
+    const query: Record<string, unknown> = (
+      countBy.mock.calls[0]![0] as { query: Record<string, unknown> }
+    ).query;
+    expect(query["triggeredByAlertId"]).toBe(alertSubjectFilter);
+    expect(query["triggeredByIncidentId"]).toBe(incidentSubjectFilter);
+  });
+
   test("alerts without a monitor skip the dedupe check entirely", async () => {
     const countBy: jest.SpyInstance = jest.spyOn(AIRunService, "countBy");
 
@@ -299,7 +330,7 @@ describe("AIInvestigationQueue concurrency cap", () => {
     jest.restoreAllMocks();
   });
 
-  test("leaves the run queued when the per-project cap is reached", async () => {
+  test("leaves the run queued when the alert cap is reached", async () => {
     jest
       .spyOn(AIRunService, "countBy")
       .mockResolvedValue(new PositiveNumber(3));
@@ -335,10 +366,12 @@ describe("AIInvestigationQueue concurrency cap", () => {
     expect(claim).not.toHaveBeenCalled();
   });
 
-  test("a per-project cap override of 1 blocks the second concurrent run", async () => {
+  test("an alert cap override of 1 blocks the second concurrent alert run", async () => {
     jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
       id: ObjectID.generate(),
-      aiMaxConcurrentInvestigations: 1,
+      aiMaxConcurrentInvestigations: 10,
+      incidentAiMaxConcurrentInvestigations: 10,
+      alertAiMaxConcurrentInvestigations: 1,
     } as unknown as Project);
     jest
       .spyOn(AIRunService, "countBy")