@oneuptime/common 12.0.5 → 12.0.7

package/Tests/Models/DatabaseModels/DataSourceModelSecrets.test.ts

@@ -0,0 +1,70 @@
+import DataSource from "../../../Models/DatabaseModels/DataSource";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import Permission from "../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * The entire mechanism keeping data source credentials out of API
+ * responses is (a) `encrypted: true` so they're ciphertext at rest and
+ * (b) `read: []` so the CRUD layer never serves the (auto-decrypted)
+ * plaintext. Decryption happens automatically on every server-side find,
+ * so a single permission added to a secret column's read list would leak
+ * plaintext credentials to that role. These tests pin both properties.
+ */
+
+const SECRET_COLUMNS: Array<string> = ["password", "apiToken", "customHeaders"];
+
+describe("DataSource model credential columns", () => {
+  const model: DataSource = new DataSource();
+  const accessControl: Record<string, ColumnAccessControl> =
+    model.getColumnAccessControlForAllColumns();
+
+  it("encrypts every secret column at rest", () => {
+    const encryptedColumns: Array<string> = model.getEncryptedColumns().columns;
+
+    for (const column of SECRET_COLUMNS) {
+      expect(encryptedColumns).toContain(column);
+    }
+  });
+
+  it("never exposes a secret column through the CRUD read path", () => {
+    for (const column of SECRET_COLUMNS) {
+      const columnAccessControl: ColumnAccessControl | undefined =
+        accessControl[column];
+      expect(columnAccessControl).toBeDefined();
+      expect(columnAccessControl!.read).toEqual([]);
+    }
+  });
+
+  it("keeps secret columns writable so users can set and rotate them", () => {
+    for (const column of SECRET_COLUMNS) {
+      const columnAccessControl: ColumnAccessControl | undefined =
+        accessControl[column];
+      expect(columnAccessControl!.create.length).toBeGreaterThan(0);
+      expect(columnAccessControl!.update.length).toBeGreaterThan(0);
+    }
+  });
+
+  it("keeps non-secret connection columns readable for the settings UI", () => {
+    for (const column of [
+      "name",
+      "dataSourceType",
+      "url",
+      "databaseHost",
+      "databasePort",
+      "databaseName",
+      "username",
+    ]) {
+      const columnAccessControl: ColumnAccessControl | undefined =
+        accessControl[column];
+      expect(columnAccessControl).toBeDefined();
+      expect(columnAccessControl!.read).toContain(Permission.ReadDataSource);
+    }
+  });
+
+  it("lets project viewers read the table so dashboards render for them", () => {
+    const tableReadPermissions: Array<Permission> = model.getReadPermissions();
+    expect(tableReadPermissions).toContain(Permission.Viewer);
+    expect(tableReadPermissions).toContain(Permission.ProjectMember);
+  });
+});

package/Tests/Models/DatabaseModels/DeletedProjectModel.test.ts

@@ -0,0 +1,251 @@
+import Models from "../../../Models/DatabaseModels/Index";
+import DeletedProject from "../../../Models/DatabaseModels/DeletedProject";
+import Project from "../../../Models/DatabaseModels/Project";
+import User from "../../../Models/DatabaseModels/User";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Migrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import TableColumnType from "../../../Types/Database/TableColumnType";
+import Permission from "../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * DeletedProject is the only record that a deleted project ever existed -
+ * projects are hard deleted, so anything this table does not carry is gone for
+ * good. These tests pin the two properties that cannot be observed from the
+ * service tests: that the snapshot is genuinely standalone (no relation to the
+ * row it describes), and that customer data in it is not reachable by ordinary
+ * project users.
+ */
+
+describe("DeletedProject model", () => {
+  const model: DeletedProject = new DeletedProject();
+
+  it("is registered in the model index, so its table is created", () => {
+    const isRegistered: boolean = Models.some(
+      (registered: { new (): BaseModel }) => {
+        return registered === DeletedProject;
+      },
+    );
+
+    expect(isRegistered).toBe(true);
+  });
+
+  it("is a global table, not scoped to the project it describes", () => {
+    /*
+     * A tenant column here would be a foreign key to Project, and Postgres
+     * would cascade the audit row away with the very project it records.
+     */
+    expect(model.getTenantColumn()).toBeFalsy();
+    expect(model.isTenantModel()).toBe(false);
+  });
+
+  it("is served from its own CRUD endpoint", () => {
+    expect(model.getCrudApiPath()?.toString()).toBe("/deleted-project");
+  });
+
+  it("uses its own table", () => {
+    expect(model.tableName).toBe("DeletedProject");
+  });
+
+  it("records the project identity, so a deleted project can still be identified", () => {
+    const columns: Array<string> = model.getTableColumns().columns;
+
+    for (const column of [
+      "projectId",
+      "projectName",
+      "projectSlug",
+      "projectCreatedAt",
+      "projectDeletedAt",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+
+  it("records who deleted the project and how to reach them", () => {
+    const columns: Array<string> = model.getTableColumns().columns;
+
+    for (const column of [
+      "projectDeletedByUserId",
+      "projectDeletedByUserName",
+      "projectDeletedByUserEmail",
+      "projectCreatedByUserId",
+      "projectCreatedByUserName",
+      "projectCreatedByUserEmail",
+      "companyName",
+      "companyPhoneNumber",
+      "companySize",
+      "jobRole",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+
+  it("records why the customer said they were leaving", () => {
+    expect(model.getTableColumns().columns).toContain("deletionReason");
+  });
+
+  it("stores the reason as unbounded text, so a long answer is not truncated", () => {
+    expect(model.getTableColumnMetadata("deletionReason").type).toBe(
+      TableColumnType.VeryLongText,
+    );
+  });
+
+  it("records what the customer was worth and how much they had built", () => {
+    const columns: Array<string> = model.getTableColumns().columns;
+
+    for (const column of [
+      "planName",
+      "paymentProviderPlanId",
+      "paymentProviderCustomerId",
+      "paymentProviderSubscriptionId",
+      "paymentProviderSubscriptionStatus",
+      "paymentProviderSubscriptionSeats",
+      "trialEndsAt",
+      "activeMonitorCount",
+      "wasProjectBlocked",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+
+  /*
+   * The project row is deleted before this one is written. A relation would
+   * have nothing to point at - which is why projectId is a plain uuid and the
+   * name, slug and dates are copied rather than joined.
+   */
+  it("keeps the project id as a plain column, not a relation to Project", () => {
+    expect(model.getTableColumnMetadata("projectId").type).toBe(
+      TableColumnType.ObjectID,
+    );
+    expect(model.getTableColumnMetadata("projectId").modelType).toBeUndefined();
+    expect(model.getTableColumns().columns).not.toContain("project");
+  });
+
+  it("requires the project id, name and deletion time on every row", () => {
+    expect(model.getTableColumnMetadata("projectId").required).toBe(true);
+    expect(model.getTableColumnMetadata("projectName").required).toBe(true);
+    expect(model.getTableColumnMetadata("projectDeletedAt").required).toBe(
+      true,
+    );
+  });
+
+  /*
+   * The user relations exist only so staff can jump to the account. They must
+   * be nullable and non-cascading: a user who later deletes their account must
+   * not take the record of the project deletion with them, which is also why
+   * the name and email are copied onto the row.
+   */
+  it("relates to the users involved without depending on them surviving", () => {
+    expect(model.getTableColumnMetadata("projectDeletedByUser").modelType).toBe(
+      User,
+    );
+    expect(model.getTableColumnMetadata("projectCreatedByUser").modelType).toBe(
+      User,
+    );
+    expect(model.getTableColumnMetadata("projectDeletedByUser").required).toBe(
+      undefined,
+    );
+  });
+
+  /*
+   * Every column carries names, emails and phone numbers of customers who have
+   * already left. Empty permission arrays are how this repo says "master admin
+   * only" - no user permission can intersect an empty list, and root and
+   * master admin bypass the check entirely.
+   */
+  it("cannot be read, written or deleted by any project user", () => {
+    expect(model.getCreatePermissions()).toEqual([]);
+    expect(model.getReadPermissions()).toEqual([]);
+    expect(model.getUpdatePermissions()).toEqual([]);
+    expect(model.getDeletePermissions()).toEqual([]);
+  });
+
+  it("locks down every single column, not just the table", () => {
+    const accessControl: Record<string, ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    /*
+     * _id and the timestamps come from the base model and carry no column
+     * access control of their own. Every column this model declares must have
+     * one - a column added without the decorator is the case worth catching,
+     * so its absence fails rather than being skipped.
+     */
+    const baseModelColumns: Array<string> = [
+      "_id",
+      "createdAt",
+      "updatedAt",
+      "deletedAt",
+      "version",
+    ];
+
+    const declaredColumns: Array<string> = model
+      .getTableColumns()
+      .columns.filter((columnName: string) => {
+        return !baseModelColumns.includes(columnName);
+      });
+
+    expect(declaredColumns.length).toBeGreaterThan(20);
+
+    for (const columnName of declaredColumns) {
+      const columnAccess: ColumnAccessControl | undefined =
+        accessControl[columnName];
+
+      expect(columnAccess).toBeDefined();
+      expect(columnAccess?.create).toEqual([]);
+      expect(columnAccess?.read).toEqual([]);
+      expect(columnAccess?.update).toEqual([]);
+    }
+  });
+
+  it("does not hand a project owner any permission over it", () => {
+    expect(model.getReadPermissions()).not.toContain(Permission.ProjectOwner);
+    expect(model.getReadPermissions()).not.toContain(Permission.ProjectAdmin);
+  });
+});
+
+describe("Project model - deletion snapshot source columns", () => {
+  const project: Project = new Project();
+
+  /*
+   * ProjectService.onBeforeDelete reads these off the project before it is
+   * deleted and DeletedProjectService copies them onto the audit row. If one
+   * is renamed the snapshot silently loses a field, so pin them here.
+   */
+  it("still has every column the deletion snapshot copies", () => {
+    const columns: Array<string> = project.getTableColumns().columns;
+
+    for (const column of [
+      "name",
+      "slug",
+      "planName",
+      "paymentProviderPlanId",
+      "paymentProviderCustomerId",
+      "paymentProviderSubscriptionId",
+      "paymentProviderSubscriptionStatus",
+      "paymentProviderSubscriptionSeats",
+      "trialEndsAt",
+      "currentActiveMonitorsCount",
+      "isBlocked",
+      "createdByUserId",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+});
+
+describe("DeletedProject migration", () => {
+  /*
+   * A migration that is not in this array never runs, so the table simply does
+   * not exist in a fresh database and every project delete logs an error.
+   */
+  it("is registered, so the table is actually created", () => {
+    const registeredNames: Array<string> = (
+      Migrations as unknown as Array<{ name: string }>
+    ).map((migration: { name: string }) => {
+      return migration.name;
+    });
+
+    expect(registeredNames).toContain("AddDeletedProjectTable1786461136170");
+  });
+});

package/Tests/Models/DatabaseModels/SavedViewJSONColumnTuples.test.ts

@@ -0,0 +1,115 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import MetricSavedView from "../../../Models/DatabaseModels/MetricSavedView";
+import TraceSavedView from "../../../Models/DatabaseModels/TraceSavedView";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import TelemetrySavedViewState from "../../../Types/Telemetry/TelemetrySavedViewState";
+import { readSavedViewFilters } from "../../../Utils/Telemetry/SavedViewFilters";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * A saved view's filter tuples pass through DatabaseBaseModel.toJSON twice:
+ * once in the browser on the way to the API, and once on the server on the way
+ * back out — every REST response for a model goes through it. Both directions
+ * ran the serializer that flattened nested arrays, so a row could be perfectly
+ * intact in Postgres and still reach the browser as
+ * { "0": facetKey, "1": value }.
+ *
+ * That is why this is pinned at the model layer and not only on the helper:
+ * the read path has to hold on its own, or a patched browser talking to an
+ * unpatched API is still broken.
+ */
+
+const SAVED_STATE: TelemetrySavedViewState = {
+  search: "status:error",
+  filters: [
+    ["primaryEntityId", "6512f1a0a1b2c3d4e5f60718"],
+    ["attributes.http.method", "GET"],
+  ],
+  timeRange: { range: "Past one hour" },
+  pageSize: 50,
+  rootOnly: false,
+};
+
+function readFiltersFromJSON(json: JSONObject): JSONArray {
+  return (json["query"] as JSONObject)["filters"] as JSONArray;
+}
+
+describe("Saved view JSON columns keep their filter tuples through toJSON", () => {
+  test("TraceSavedView keeps filters as arrays", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.name = "Errors in checkout";
+    view.query = SAVED_STATE;
+
+    const json: JSONObject = BaseModel.toJSON(view, TraceSavedView);
+    const filters: JSONArray = readFiltersFromJSON(json);
+
+    expect(Array.isArray(filters)).toBe(true);
+    expect(Array.isArray(filters[0])).toBe(true);
+    expect(filters).toEqual(SAVED_STATE.filters);
+  });
+
+  test("MetricSavedView keeps filters as arrays", () => {
+    const view: MetricSavedView = new MetricSavedView();
+    view.name = "Hot services";
+    view.query = SAVED_STATE;
+
+    const json: JSONObject = BaseModel.toJSON(view, MetricSavedView);
+    const filters: JSONArray = readFiltersFromJSON(json);
+
+    expect(Array.isArray(filters)).toBe(true);
+    expect(Array.isArray(filters[0])).toBe(true);
+    expect(filters).toEqual(SAVED_STATE.filters);
+  });
+
+  test("A serialized view is still readable by the explorer", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.query = SAVED_STATE;
+
+    const json: JSONObject = BaseModel.toJSON(view, TraceSavedView);
+
+    expect(readSavedViewFilters(readFiltersFromJSON(json))).toEqual(
+      SAVED_STATE.filters,
+    );
+  });
+
+  test("The rest of the saved state is untouched", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.query = SAVED_STATE;
+
+    const query: JSONObject = BaseModel.toJSON(view, TraceSavedView)[
+      "query"
+    ] as JSONObject;
+
+    expect(query["search"]).toBe("status:error");
+    expect(query["pageSize"]).toBe(50);
+    expect(query["rootOnly"]).toBe(false);
+    expect(query["timeRange"]).toEqual({ range: "Past one hour" });
+  });
+
+  test("A view survives two passes, the way it does browser-to-API-to-browser", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.query = SAVED_STATE;
+
+    // Write side (browser -> API), then read side (API -> browser).
+    const written: JSONObject = BaseModel.toJSON(view, TraceSavedView);
+    const reloaded: TraceSavedView = BaseModel.fromJSON(
+      written,
+      TraceSavedView,
+    ) as TraceSavedView;
+    const returned: JSONObject = BaseModel.toJSON(reloaded, TraceSavedView);
+
+    expect(readFiltersFromJSON(returned)).toEqual(SAVED_STATE.filters);
+  });
+
+  test("A view with no filters serializes without inventing any", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.query = { search: "status:error" };
+
+    const query: JSONObject = BaseModel.toJSON(view, TraceSavedView)[
+      "query"
+    ] as JSONObject;
+
+    expect(query["filters"]).toBeUndefined();
+    expect(readSavedViewFilters(query["filters"])).toEqual([]);
+  });
+});

package/Tests/Server/API/AIInvestigationAPI.test.ts

@@ -69,6 +69,7 @@ function investigationRun(data: {
   status: AIRunStatus;
   createdAt?: Date | undefined;
   completedAt?: Date | undefined;
+  analysisTldr?: string | undefined;
 }): AIRun {
   const run: AIRun = new AIRun(
     new ObjectID("eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee"),
@@ -80,6 +81,9 @@ function investigationRun(data: {
   if (data.completedAt) {
     run.completedAt = data.completedAt;
   }
+  if (data.analysisTldr !== undefined) {
+    run.analysisTldr = data.analysisTldr;
+  }
   return run;
 }
 
@@ -154,6 +158,7 @@ describe("AIInvestigationAPI latest-investigation payload", () => {
       run: null,
       events: [],
       analysisMarkdown: null,
+      analysisTldr: null,
       isAnalysisPending: false,
     });
     expect(PostedRootCause.getForInvestigation).not.toHaveBeenCalled();
@@ -212,6 +217,188 @@ describe("AIInvestigationAPI latest-investigation payload", () => {
     );
   });
 
+  /*
+   * The TL;DR summarizes the report, so the payload must never carry one
+   * without the report it describes — a reader would otherwise see a claim
+   * with nothing to check it against.
+   */
+  it("returns the stored TL;DR alongside a published report", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Completed,
+        createdAt: new Date("2026-08-07T09:55:00.000Z"),
+        completedAt: new Date("2026-08-07T10:00:00.000Z"),
+        analysisTldr: "The checkout API is failing on an exhausted pool.",
+      }),
+      analysisMarkdown: "## Current investigation\nPool exhausted.",
+    });
+
+    expect(sentPayload()).toEqual(
+      expect.objectContaining({
+        analysisTldr: "The checkout API is failing on an exhausted pool.",
+      }),
+    );
+  });
+
+  /*
+   * The column is selected, so it also travels inside the serialized run.
+   * Both copies must obey the same gate — otherwise a client reading
+   * run.analysisTldr shows a summary of a report the payload does not carry.
+   */
+  it("applies the report gate to the serialized run as well as the top-level field", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Completed,
+        createdAt: new Date("2026-08-07T10:00:00.000Z"),
+        completedAt: new Date(Date.now() - 1000),
+        analysisTldr: "The checkout API is failing on an exhausted pool.",
+      }),
+    });
+
+    const payload: JSONObject = sentPayload();
+    expect(payload["analysisTldr"]).toBeNull();
+    expect((payload["run"] as JSONObject)["analysisTldr"]).toBeNull();
+  });
+
+  it("carries the same TL;DR in the run and at the top level once the report exists", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Completed,
+        createdAt: new Date("2026-08-07T09:55:00.000Z"),
+        completedAt: new Date("2026-08-07T10:00:00.000Z"),
+        analysisTldr: "The checkout API is failing on an exhausted pool.",
+      }),
+      analysisMarkdown: "## Current investigation\nPool exhausted.",
+    });
+
+    const payload: JSONObject = sentPayload();
+    expect(payload["analysisTldr"]).toBe(
+      "The checkout API is failing on an exhausted pool.",
+    );
+    expect((payload["run"] as JSONObject)["analysisTldr"]).toBe(
+      payload["analysisTldr"],
+    );
+  });
+
+  it("normalizes the run's blank TL;DR to null too", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Completed,
+        createdAt: new Date("2026-08-07T09:55:00.000Z"),
+        completedAt: new Date("2026-08-07T10:00:00.000Z"),
+        analysisTldr: "   ",
+      }),
+      analysisMarkdown: "## Current investigation\nPool exhausted.",
+    });
+
+    expect((sentPayload()["run"] as JSONObject)["analysisTldr"]).toBeNull();
+  });
+
+  /*
+   * The route always returns the LATEST run, while the report is bound to
+   * that run's id. A re-investigation therefore replaces both — and must not
+   * leave the previous run's summary on screen describing an analysis the
+   * payload no longer carries.
+   */
+  it("never shows a previous run's summary once a new run supersedes it", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Running,
+        createdAt: new Date("2026-08-07T11:00:00.000Z"),
+      }),
+    });
+
+    const payload: JSONObject = sentPayload();
+    expect(payload["analysisMarkdown"]).toBeNull();
+    expect(payload["analysisTldr"]).toBeNull();
+    expect((payload["run"] as JSONObject)["analysisTldr"]).toBeNull();
+  });
+
+  it("selects the TL;DR column so a live panel can render it", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Completed,
+        createdAt: new Date("2026-08-07T09:55:00.000Z"),
+        completedAt: new Date("2026-08-07T10:00:00.000Z"),
+      }),
+      analysisMarkdown: "## Current investigation\nPool exhausted.",
+    });
+
+    expect(AIRunService.findBy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        select: expect.objectContaining({ analysisTldr: true }),
+      }),
+    );
+  });
+
+  it("withholds the TL;DR while the report is still being published", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Completed,
+        createdAt: new Date("2026-08-07T10:00:00.000Z"),
+        completedAt: new Date(Date.now() - 1000),
+        analysisTldr: "The checkout API is failing on an exhausted pool.",
+      }),
+    });
+
+    expect(sentPayload()).toEqual(
+      expect.objectContaining({
+        analysisMarkdown: null,
+        analysisTldr: null,
+        isAnalysisPending: true,
+      }),
+    );
+  });
+
+  it("normalizes a blank stored TL;DR to null so the panel has one empty shape", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Completed,
+        createdAt: new Date("2026-08-07T09:55:00.000Z"),
+        completedAt: new Date("2026-08-07T10:00:00.000Z"),
+        analysisTldr: "   \n  ",
+      }),
+      analysisMarkdown: "## Current investigation\nPool exhausted.",
+    });
+
+    expect(sentPayload()).toEqual(
+      expect.objectContaining({ analysisTldr: null }),
+    );
+  });
+
+  it("reports no TL;DR for a legacy run that predates the column", async () => {
+    await callIncidentRoute({
+      run: investigationRun({
+        status: AIRunStatus.Completed,
+        createdAt: new Date("2026-08-07T09:55:00.000Z"),
+        completedAt: new Date("2026-08-07T10:00:00.000Z"),
+      }),
+      analysisMarkdown: "## Current investigation\nPool exhausted.",
+    });
+
+    expect(sentPayload()).toEqual(
+      expect.objectContaining({ analysisTldr: null }),
+    );
+  });
+
+  it.each([AIRunStatus.Running, AIRunStatus.Error])(
+    "never reports a TL;DR for a %s run",
+    async (status: AIRunStatus) => {
+      await callIncidentRoute({
+        run: investigationRun({
+          status,
+          createdAt: new Date("2026-08-07T09:55:00.000Z"),
+          completedAt: new Date("2026-08-07T10:00:00.000Z"),
+          analysisTldr: "The checkout API is failing on an exhausted pool.",
+        }),
+      });
+
+      expect(sentPayload()).toEqual(
+        expect.objectContaining({ analysisTldr: null }),
+      );
+    },
+  );
+
   it("returns a branded pre-migration report through the null-associated legacy path", async () => {
     const run: AIRun = investigationRun({
       status: AIRunStatus.Completed,