npm - @oneuptime/common - Versions diffs - 12.0.5 → 12.0.7 - Mend

@oneuptime/common 12.0.5 → 12.0.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (901) hide show

package/Tests/Server/Views/OfflineRender.test.ts ADDED Viewed

@@ -0,0 +1,297 @@
+import { describe, expect, test } from "@jest/globals";
+import ejs from "ejs";
+import fs from "fs";
+import path from "path";
+import { VendorAssetsPath } from "../../../Server/Utils/VendorAssets";
+/*
+ * Renders the pages, rather than reading them.
+ *
+ * The static scan in OfflineAssetHygiene.test.ts reads each .ejs on its own,
+ * so it cannot see what an include pulls in - and every one of these pages
+ * gets its <head>, and therefore all of its assets, from a partial. Rendering
+ * is the only way to assert on the HTML a browser is actually handed.
+ *
+ * These are also the pages where the failure hurts most: an on-call engineer
+ * following an acknowledge link from the alert they were just paged by, and
+ * someone completing an SSO round trip. Both come out of the App/API
+ * container, which is what nginx routes "/" to on every install with billing
+ * off.
+ */
+const REPOSITORY_ROOT: string = path.resolve(__dirname, "..", "..", "..", "..");
+interface Page {
+  label: string;
+  viewPath: string;
+  variables: Record<string, unknown>;
+}
+/*
+ * Only the elements whose URL the browser goes and fetches while building the
+ * page. A <meta property="og:image"> pointing at oneuptime.com, a schema.org
+ * blob, and the acknowledge button's own <a href> all name absolute URLs and
+ * none of them can hang a render - the acknowledge link in particular has to
+ * be absolute, because it arrives by SMS.
+ */
+const SUBRESOURCE_ELEMENT: RegExp =
+  /<(?:script|link|img|iframe|source|embed|object|video|audio)\b[^>]*>/gi;
+const SUBRESOURCE_URL_ATTRIBUTE: RegExp =
+  /(?:src|href|data)\s*=\s*["'](?:https?:)?\/\/([^/"']+)/i;
+/*
+ * Prefetch hints cost a DNS lookup and nothing else, but they are still a hint
+ * at a host this page expects to talk to, so they count. rel=canonical and
+ * rel=alternate are pure metadata and do not.
+ */
+const METADATA_ONLY_LINK: RegExp = /rel=["'](?:canonical|alternate)["']/i;
+/* @import and background-image: url(...) fetch just as hard as a <link>. */
+const CSS_URL: RegExp = /url\(\s*["']?(?:https?:)?\/\/([^/"')]+)/gi;
+const PAGES: Array<Page> = [
+  {
+    label: "on-call acknowledge",
+    viewPath: path.join(
+      REPOSITORY_ROOT,
+      "Common",
+      "Server",
+      "Views",
+      "AcknowledgeUserOnCallNotification.ejs",
+    ),
+    variables: {
+      title: "Acknowledge Incident - Database is down",
+      message: "Do you want to acknowledge this Incident?",
+      acknowledgeText: "Acknowledge Incident",
+      acknowledgeUrl: "https://oneuptime.example.com/api/ack/1",
+    },
+  },
+  {
+    label: "on-call message",
+    viewPath: path.join(
+      REPOSITORY_ROOT,
+      "Common",
+      "Server",
+      "Views",
+      "ViewMessage.ejs",
+    ),
+    variables: {
+      title: "Notification Already Acknowledged",
+      message: "This notification has already been acknowledged.",
+      viewDetailsText: "View Incident",
+      viewDetailsUrl: "https://oneuptime.example.com/dashboard/incident/1",
+    },
+  },
+  {
+    label: "SSO message",
+    viewPath: path.join(
+      REPOSITORY_ROOT,
+      "App",
+      "FeatureSet",
+      "Identity",
+      "Views",
+      "Message.ejs",
+    ),
+    variables: {
+      title: "Single Sign On",
+      message: "You have been logged out.",
+    },
+  },
+];
+function render(page: Page, extraVariables: Record<string, unknown>): string {
+  return ejs.render(
+    fs.readFileSync(page.viewPath, "utf8"),
+    { ...page.variables, ...extraVariables },
+    { filename: page.viewPath },
+  );
+}
+function externalHostsFetchedBy(html: string): Array<string> {
+  const hosts: Set<string> = new Set<string>();
+  for (const element of html.match(SUBRESOURCE_ELEMENT) || []) {
+    if (METADATA_ONLY_LINK.test(element)) {
+      continue;
+    }
+    const url: RegExpMatchArray | null = element.match(
+      SUBRESOURCE_URL_ATTRIBUTE,
+    );
+    if (url && url[1]) {
+      hosts.add(url[1]);
+    }
+  }
+  for (const match of html.matchAll(CSS_URL)) {
+    if (match[1]) {
+      hosts.add(match[1]);
+    }
+  }
+  return Array.from(hosts).sort();
+}
+describe("the detector these pages are checked with", () => {
+  /*
+   * An assertion that a page fetches nothing off-box is only worth as much as
+   * the thing doing the looking. Without this, a typo in the regex would make
+   * every test in this file pass on a page full of CDN tags.
+   */
+  test("catches the exact tags this change removed", () => {
+    expect(
+      externalHostsFetchedBy(
+        '<script src="https://cdn.tailwindcss.com"></script>',
+      ),
+    ).toEqual(["cdn.tailwindcss.com"]);
+    expect(
+      externalHostsFetchedBy(
+        '<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/vs2015.min.css">',
+      ),
+    ).toEqual(["cdnjs.cloudflare.com"]);
+    expect(
+      externalHostsFetchedBy(
+        '<script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>',
+      ),
+    ).toEqual(["cdnjs.cloudflare.com"]);
+    expect(
+      externalHostsFetchedBy(
+        '<link href="https://fonts.googleapis.com/css2?family=Inter" rel="stylesheet">',
+      ),
+    ).toEqual(["fonts.googleapis.com"]);
+    expect(
+      externalHostsFetchedBy(
+        "<style>@font-face { src: url('https://fonts.gstatic.com/s/inter.woff2'); }</style>",
+      ),
+    ).toEqual(["fonts.gstatic.com"]);
+  });
+  test("ignores the absolute URLs a notification page legitimately carries", () => {
+    expect(
+      externalHostsFetchedBy(
+        '<a href="https://oneuptime.example.com/api/ack/1">Acknowledge</a>',
+      ),
+    ).toEqual([]);
+    expect(
+      externalHostsFetchedBy(
+        '<meta property="og:image" content="https://oneuptime.com/img/hou-wb.svg">',
+      ),
+    ).toEqual([]);
+    expect(
+      externalHostsFetchedBy(
+        '<link rel="canonical" href="https://oneuptime.com/docs">',
+      ),
+    ).toEqual([]);
+  });
+  test("does not treat a local path as an external host", () => {
+    expect(
+      externalHostsFetchedBy(
+        '<script src="/oneuptime-assets/tailwind/tailwind-3.4.5.js"></script>',
+      ),
+    ).toEqual([]);
+  });
+});
+describe("server-rendered notification pages", () => {
+  for (const page of PAGES) {
+    describe(page.label, () => {
+      describe("with the default Response.render supplies for a self-hosted install", () => {
+        test("fetches nothing from another host", () => {
+          expect(
+            externalHostsFetchedBy(
+              render(page, { enableGoogleTagManager: false }),
+            ),
+          ).toEqual([]);
+        });
+        test("loads Tailwind from this install", () => {
+          expect(render(page, { enableGoogleTagManager: false })).toContain(
+            '<script src="/oneuptime-assets/tailwind/tailwind-3.4.5.js"></script>',
+          );
+        });
+        test("carries no Google Tag Manager snippet", () => {
+          expect(render(page, { enableGoogleTagManager: false })).not.toContain(
+            "googletagmanager.com",
+          );
+        });
+      });
+      describe("when the flag is missing entirely", () => {
+        /*
+         * Every Response.render call site predates the flag and none of them
+         * pass it. The partials have to treat "undefined" as off, or the guard
+         * is decoration.
+         */
+        test("still leaves analytics out", () => {
+          expect(render(page, {})).not.toContain("googletagmanager.com");
+        });
+        test("still renders the page body", () => {
+          expect(render(page, {})).toContain(String(page.variables["message"]));
+        });
+      });
+      describe("on the hosted product", () => {
+        test("keeps analytics working", () => {
+          expect(render(page, { enableGoogleTagManager: true })).toContain(
+            "googletagmanager.com",
+          );
+        });
+        test("still loads no library from a CDN", () => {
+          /*
+           * GTM injects itself by script rather than through a src attribute,
+           * so it is not in the set this returns - which is the point: nothing
+           * that blocks a render comes from off-box either way.
+           */
+          expect(
+            externalHostsFetchedBy(
+              render(page, { enableGoogleTagManager: true }),
+            ),
+          ).toEqual([]);
+        });
+      });
+    });
+  }
+  describe("the font the on-call pages ask for", () => {
+    const html: string = render(PAGES[0] as Page, {
+      enableGoogleTagManager: false,
+    });
+    test("is declared as a local woff2", () => {
+      expect(html).toContain(
+        "url('/oneuptime-assets/fonts/InterVariable.woff2')",
+      );
+    });
+    test("is a file that exists", () => {
+      expect(
+        fs.existsSync(
+          path.join(VendorAssetsPath, "fonts", "InterVariable.woff2"),
+        ),
+      ).toBe(true);
+    });
+    test("is preloaded, so the swap does not flash on a cold cache", () => {
+      expect(html).toContain(
+        '<link rel="preload" href="/oneuptime-assets/fonts/InterVariable.woff2" as="font" type="font/woff2" crossorigin>',
+      );
+    });
+    test("no longer comes from Google Fonts", () => {
+      expect(html).not.toContain("fonts.googleapis.com");
+      expect(html).not.toContain("fonts.gstatic.com");
+    });
+  });
+});

package/Tests/Types/AI/AIChatMessageStatus.test.ts ADDED Viewed

@@ -0,0 +1,79 @@
+import AIChatMessageStatus, {
+  AIChatMessageStatusHelper,
+} from "../../../Types/AI/AIChatMessageStatus";
+describe("AIChatMessageStatusHelper", () => {
+  const allStatuses: Array<AIChatMessageStatus> =
+    Object.values(AIChatMessageStatus);
+  describe("isTerminalStatus", () => {
+    test("Completed and Error are terminal", () => {
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(
+          AIChatMessageStatus.Completed,
+        ),
+      ).toBe(true);
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(AIChatMessageStatus.Error),
+      ).toBe(true);
+    });
+    test("in-flight statuses are not terminal", () => {
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(AIChatMessageStatus.Pending),
+      ).toBe(false);
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(
+          AIChatMessageStatus.InProgress,
+        ),
+      ).toBe(false);
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(
+          AIChatMessageStatus.WaitingForApproval,
+        ),
+      ).toBe(false);
+    });
+  });
+  describe("isActiveStatus", () => {
+    test("Pending, InProgress and WaitingForApproval are active", () => {
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(AIChatMessageStatus.Pending),
+      ).toBe(true);
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(
+          AIChatMessageStatus.InProgress,
+        ),
+      ).toBe(true);
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(
+          AIChatMessageStatus.WaitingForApproval,
+        ),
+      ).toBe(true);
+    });
+    test("terminal statuses are not active", () => {
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(AIChatMessageStatus.Completed),
+      ).toBe(false);
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(AIChatMessageStatus.Error),
+      ).toBe(false);
+    });
+  });
+  test("active and terminal are mutually exclusive and jointly exhaustive", () => {
+    /*
+     * Every status must be exactly one of active or terminal — a status that
+     * is neither would hang a spinner forever; one that is both is a
+     * contradiction. This guards against a new enum member being added
+     * without wiring it into both predicates.
+     */
+    for (const status of allStatuses) {
+      const active: boolean = AIChatMessageStatusHelper.isActiveStatus(status);
+      const terminal: boolean =
+        AIChatMessageStatusHelper.isTerminalStatus(status);
+      expect(active).not.toBe(terminal);
+    }
+  });
+});

package/Tests/Types/AI/AIInsightStatus.test.ts ADDED Viewed

@@ -0,0 +1,40 @@
+import AIInsightStatus, {
+  AIInsightStatusHelper,
+} from "../../../Types/AI/AIInsightStatus";
+describe("AIInsightStatusHelper.isTerminalStatus", () => {
+  test("the two human end states are terminal", () => {
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.Resolved),
+    ).toBe(true);
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.Dismissed),
+    ).toBe(true);
+  });
+  test("the scanner-owned lifecycle states are not terminal", () => {
+    /*
+     * Detected/ActionRequired/FixOpened are the states a detector may still
+     * refresh (dedupe into). If any were treated as terminal the scanner
+     * would stop updating a live insight.
+     */
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.Detected),
+    ).toBe(false);
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.ActionRequired),
+    ).toBe(false);
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.FixOpened),
+    ).toBe(false);
+  });
+  test("exactly two of the five statuses are terminal", () => {
+    const terminalCount: number = Object.values(AIInsightStatus).filter(
+      (status: AIInsightStatus) => {
+        return AIInsightStatusHelper.isTerminalStatus(status);
+      },
+    ).length;
+    expect(terminalCount).toBe(2);
+  });
+});

package/Tests/Types/API/HostnameAuthorityParsing.test.ts ADDED Viewed

@@ -0,0 +1,157 @@
+import Hostname from "../../../Types/API/Hostname";
+import URL from "../../../Types/API/URL";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { describe, expect, test } from "@jest/globals";
+/*
+ * Hostname used to validate with a character allowlist that happened to
+ * include "/", "?", "#" and "@". Anything that stores a Hostname and later
+ * interpolates it into a URL therefore inherited control of the host, port
+ * AND path of the resulting request — which is how a status page subdomain of
+ * "169.254.169.254/latest/meta-data/#" became a request to the cloud metadata
+ * endpoint. These tests pin the structural rules that replaced it, and the
+ * matching fix in URL.fromString, which used to leave a query string glued to
+ * the host.
+ */
+describe("Hostname.isValid accepts real hosts", () => {
+  const validHostnames: Array<string> = [
+    "localhost",
+    "localhost:5000",
+    "example.com",
+    "status.example.com",
+    "deep.sub.domain.example.com",
+    "example.com.",
+    "EXAMPLE.com",
+    "my-host.internal",
+    "host_with_underscore.internal",
+    "_dmarc.example.com",
+    "1.2.3.4",
+    "1.2.3.4:8080",
+    "smtp.example.com:587",
+    "[::1]",
+    "[::1]:8080",
+    "[2606:2800:220:1:248:1893:25c8:1946]:443",
+    "::1",
+    "2606:2800:220:1:248:1893:25c8:1946",
+    // Userinfo is still accepted: it is already in customers' stored URLs.
+    "user:token@hooks.example.com",
+    "user@hooks.example.com",
+    "user:token@hooks.example.com:8443",
+  ];
+  test.each(validHostnames)("accepts %s", (hostname: string) => {
+    expect(Hostname.isValid(hostname)).toBe(true);
+  });
+});
+describe("Hostname.isValid rejects smuggled paths, queries and fragments", () => {
+  const invalidHostnames: Array<string> = [
+    // The status page / dashboard subdomain injection.
+    "169.254.169.254/latest/meta-data/#",
+    "169.254.169.254/latest/meta-data/#.example.com",
+    "example.com/../../etc/passwd",
+    "example.com/path",
+    "example.com?query=1",
+    "example.com#fragment",
+    "example.com:8080/path",
+    // Junk the old character allowlist waved through.
+    "example.com;evil",
+    "example.com,evil",
+    "exa mple.com",
+    "undefined undefined",
+    "localhost 5000",
+    "",
+    "   ",
+    // A port that is not a port.
+    "example.com:notaport",
+    "example.com:80:90",
+    // Hyphen placement.
+    "-example.com",
+    "example-.com",
+    // Userinfo may not itself carry a path or a second authority.
+    "user@evil.com/@example.com",
+    "user@example.com?x=1",
+  ];
+  test.each(invalidHostnames)("rejects %s", (hostname: string) => {
+    expect(Hostname.isValid(hostname)).toBe(false);
+  });
+  test("the constructor throws rather than storing a smuggled value", () => {
+    expect(() => {
+      return new Hostname("169.254.169.254/latest/meta-data/#");
+    }).toThrow(BadDataException);
+  });
+});
+describe("URL.fromString keeps the authority separate from the rest", () => {
+  test("a query string on a path-less URL does not end up in the host", () => {
+    const url: URL = URL.fromString("https://hooks.example.com?token=abc");
+    expect(url.hostname.hostname).toBe("hooks.example.com");
+    expect(url.getQueryParam("token")).toBe("abc");
+  });
+  test("a fragment on a path-less URL does not end up in the host", () => {
+    const url: URL = URL.fromString("https://hooks.example.com#section");
+    expect(url.hostname.hostname).toBe("hooks.example.com");
+  });
+  test("a path still parses as a route", () => {
+    const url: URL = URL.fromString("https://hooks.example.com/a/b?x=1");
+    expect(url.hostname.hostname).toBe("hooks.example.com");
+    expect(url.route.toString()).toBe("a/b");
+    expect(url.getQueryParam("x")).toBe("1");
+    expect(url.toString()).toBe("https://hooks.example.com/a/b?x=1");
+  });
+  test("an upper-case scheme is stripped, not left in the authority", () => {
+    /*
+     * Schemes are case-insensitive. Matching the literal lower-case prefix
+     * left "HTTPS://" in place, so the authority read as "HTTPS:" — which
+     * the old permissive host check waved through and the structural one
+     * (correctly) refuses, turning a valid webhook URL into an error.
+     */
+    const url: URL = URL.fromString("HTTPS://hooks.example.com/webhook");
+    expect(url.hostname.hostname).toBe("hooks.example.com");
+    expect(url.protocol.toString()).toBe("https://");
+  });
+  test("a host with a port survives", () => {
+    const url: URL = URL.fromString("http://localhost:5000/api/test");
+    expect(url.hostname.toString()).toBe("localhost:5000");
+    expect(url.toString()).toBe("http://localhost:5000/api/test");
+  });
+  test("a mailto address is parsed as an email, not as a host", () => {
+    const url: URL = URL.fromString("mailto:support@oneuptime.com");
+    expect(url.email.toString()).toBe("support@oneuptime.com");
+    expect(url.toString()).toBe("mailto:support@oneuptime.com");
+  });
+  test("a mailto address with a subject does not go through the host validator", () => {
+    const url: URL = URL.fromString(
+      "mailto:support@oneuptime.com?subject=Hello",
+    );
+    expect(url.email.toString()).toBe("support@oneuptime.com");
+    expect(url.getQueryParam("subject")).toBe("Hello");
+  });
+  test("a webhook URL with basic-auth credentials still round-trips", () => {
+    /*
+     * These are already in customers' databases. Rejecting them here would
+     * fail on read, not just on write.
+     */
+    const url: URL = URL.fromString("https://user:token@hooks.example.com/x");
+    expect(url.hostname.hostname).toBe("user:token@hooks.example.com");
+    expect(url.toString()).toBe("https://user:token@hooks.example.com/x");
+  });
+});

package/Tests/Types/Dashboard/DashboardTemplateInvariants.test.ts CHANGED Viewed

@@ -767,6 +767,33 @@ describe("DashboardTemplates invariants (all templates)", () => {
       }
     });
+    /*
+     * A multi-select variable resolves from its picks alone, and starts
+     * with none — so it opens on "All" and `defaultValue` never applies
+     * (see DashboardVariableInterpolation.resolveValue). A template that
+     * shipped one would look like it scoped its widgets and would not.
+     * Templates that want an opening scope must use a single-select.
+     */
+    test("no template ships a multi-select variable with a default", (): void => {
+      const offenders: Array<string> = [];
+      let multiSelectVariables: number = 0;
+      for (const loaded of loadAllTemplates()) {
+        for (const variable of loaded.config.variables || []) {
+          if (!variable.isMultiSelect) {
+            continue;
+          }
+          multiSelectVariables++;
+          if ((variable.defaultValue ?? "").length > 0) {
+            offenders.push(`${loaded.type} variable "${variable.name}"`);
+          }
+        }
+      }
+      expect(multiSelectVariables).toBeGreaterThan(0);
+      expect(offenders).toEqual([]);
+    });
     test("variable ids are freshly generated on every call", (): void => {
       const typesWithVariables: Array<DashboardTemplateType> =
         TEMPLATE_TYPES_WITH_CONFIG.filter(