@oneuptime/common 12.0.6 → 12.0.7

package/Tests/Server/Utils/AI/LLMServiceEgressGuard.test.ts

@@ -0,0 +1,315 @@
+import API, { RequestOptions } from "../../../../Utils/API";
+import HTTPResponse from "../../../../Types/API/HTTPResponse";
+import { JSONObject } from "../../../../Types/JSON";
+import LlmType from "../../../../Types/LLM/LlmType";
+import LLMService from "../../../../Server/Utils/LLM/LLMService";
+import DataSourceEgressGuard, {
+  EgressResolveFunction,
+  ResolvedAddress,
+} from "../../../../Server/Utils/DataSource/EgressGuard";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import dns from "dns";
+
+/*
+ * LlmProvider.baseUrl is writable by any ProjectMember, while reading the
+ * provider's apiKey is restricted to Owner/Admin. So an unguarded outbound
+ * request is a privilege escalation with two payouts: the decrypted key goes
+ * out in the auth header of a request to a host the member chose, and the
+ * provider's error body is reflected back through the LLM provider API, which
+ * turns the same lever into a read primitive against the internal network.
+ *
+ * These tests assert that no request leaves for an internal address, that the
+ * checked address is pinned into the socket, and that redirects are refused.
+ * DNS is mocked so they are deterministic and offline.
+ */
+
+type LookupSpy = jest.SpiedFunction<
+  (
+    hostname: string,
+    options: { all: true },
+  ) => Promise<Array<{ address: string; family: number }>>
+>;
+
+let lookupSpy: LookupSpy;
+
+// Every API.post the service made, so tests can assert on "never sent".
+const postCalls: Array<{ options?: RequestOptions | undefined }> = [];
+
+function mockPostSuccess(): void {
+  jest.spyOn(API, "post").mockImplementation(((options: {
+    options?: RequestOptions | undefined;
+  }) => {
+    postCalls.push(options);
+
+    return Promise.resolve({
+      jsonData: {
+        choices: [{ message: { content: "ok" } }],
+        content: [{ type: "text", text: "ok" }],
+        message: { content: "ok" },
+        usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 },
+      },
+    } as unknown as HTTPResponse<JSONObject>);
+  }) as never);
+}
+
+function lastPostOptions(): RequestOptions {
+  return postCalls[postCalls.length - 1]!.options as RequestOptions;
+}
+
+beforeEach(() => {
+  postCalls.length = 0;
+  lookupSpy = jest.spyOn(dns.promises, "lookup") as unknown as LookupSpy;
+
+  /*
+   * Stand in for getaddrinfo: "localhost" is loopback, everything else is a
+   * public address. Individual tests override this to model rebinding.
+   */
+  lookupSpy.mockImplementation((hostname: string) => {
+    if (hostname === "localhost") {
+      return Promise.resolve([{ address: "127.0.0.1", family: 4 }]);
+    }
+
+    return Promise.resolve([{ address: "93.184.216.34", family: 4 }]);
+  });
+
+  mockPostSuccess();
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("LLMService refuses internal LLM provider base URLs", () => {
+  const blockedBaseUrls: Array<string> = [
+    "http://127.0.0.1:11434",
+    "http://localhost:11434",
+    "http://169.254.169.254",
+    "http://169.254.169.254:80",
+    "http://[::1]:11434",
+    "http://0.0.0.0:11434",
+  ];
+
+  test.each(blockedBaseUrls)(
+    "OpenAI-compatible provider at %s never posts",
+    async (baseUrl: string) => {
+      await expect(
+        LLMService.getCompletion({
+          llmProviderConfig: {
+            llmType: LlmType.OpenAICompatible,
+            apiKey: "sk-secret",
+            modelName: "some-model",
+            baseUrl,
+          },
+          messages: [{ role: "user", content: "hi" }],
+        }),
+      ).rejects.toThrow();
+
+      expect(postCalls).toHaveLength(0);
+    },
+  );
+
+  test("Ollama provider at a loopback base URL never posts", async () => {
+    await expect(
+      LLMService.getCompletion({
+        llmProviderConfig: {
+          llmType: LlmType.Ollama,
+          modelName: "llama2",
+          baseUrl: "http://127.0.0.1:11434",
+        },
+        messages: [{ role: "user", content: "hi" }],
+      }),
+    ).rejects.toThrow();
+
+    expect(postCalls).toHaveLength(0);
+  });
+
+  test("Anthropic provider repointed at the metadata endpoint never posts", async () => {
+    await expect(
+      LLMService.getCompletion({
+        llmProviderConfig: {
+          llmType: LlmType.Anthropic,
+          apiKey: "sk-ant-secret",
+          modelName: "claude-sonnet-4-20250514",
+          baseUrl: "http://169.254.169.254/latest",
+        },
+        messages: [{ role: "user", content: "hi" }],
+      }),
+    ).rejects.toThrow();
+
+    expect(postCalls).toHaveLength(0);
+  });
+
+  test("Azure provider repointed at loopback never posts", async () => {
+    await expect(
+      LLMService.getCompletion({
+        llmProviderConfig: {
+          llmType: LlmType.AzureOpenAI,
+          apiKey: "azure-secret",
+          modelName: "gpt-4o",
+          baseUrl: "http://127.0.0.1/openai/deployments/gpt-4o",
+        },
+        messages: [{ role: "user", content: "hi" }],
+      }),
+    ).rejects.toThrow();
+
+    expect(postCalls).toHaveLength(0);
+  });
+
+  test("a public hostname that resolves to a private address never posts", async () => {
+    // The DNS-rebinding shape: the name looks fine, the answer does not.
+    lookupSpy.mockResolvedValue([{ address: "10.0.0.5", family: 4 }]);
+
+    /*
+     * Private ranges are only blocked under SaaS policy; this is the
+     * documented switch that turns it on for a self-hosted install.
+     */
+    process.env["DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES"] = "true";
+
+    try {
+      await expect(
+        LLMService.getCompletion({
+          llmProviderConfig: {
+            llmType: LlmType.OpenAICompatible,
+            apiKey: "sk-secret",
+            modelName: "some-model",
+            baseUrl: "https://ollama.attacker.example/v1",
+          },
+          messages: [{ role: "user", content: "hi" }],
+        }),
+      ).rejects.toThrow();
+    } finally {
+      delete process.env["DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES"];
+    }
+
+    expect(postCalls).toHaveLength(0);
+  });
+});
+
+describe("LLMService pins and refuses redirects on allowed providers", () => {
+  test("a public provider posts with redirects disabled and pinned agents", async () => {
+    await LLMService.getCompletion({
+      llmProviderConfig: {
+        llmType: LlmType.OpenAICompatible,
+        apiKey: "sk-secret",
+        modelName: "some-model",
+        baseUrl: "https://gateway.example.com/v1",
+      },
+      messages: [{ role: "user", content: "hi" }],
+    });
+
+    const options: RequestOptions = lastPostOptions();
+
+    expect(options.doNotFollowRedirects).toBe(true);
+    expect(options.httpAgent).toBeDefined();
+    expect(options.httpsAgent).toBeDefined();
+  });
+
+  test("the pinned agent dials the address that was validated", async () => {
+    lookupSpy.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+
+    await LLMService.getCompletion({
+      llmProviderConfig: {
+        llmType: LlmType.Anthropic,
+        apiKey: "sk-ant-secret",
+        modelName: "claude-sonnet-4-20250514",
+        baseUrl: "https://api.anthropic.com/v1",
+      },
+      messages: [{ role: "user", content: "hi" }],
+    });
+
+    const options: RequestOptions = lastPostOptions();
+
+    const lookup: (
+      hostname: string,
+      lookupOptions: { all?: boolean },
+      callback: (error: Error | null, address: string, family?: number) => void,
+    ) => void = (
+      options.httpsAgent as unknown as {
+        options: {
+          lookup: (
+            hostname: string,
+            lookupOptions: { all?: boolean },
+            callback: (
+              error: Error | null,
+              address: string,
+              family?: number,
+            ) => void,
+          ) => void;
+        };
+      }
+    ).options.lookup;
+
+    const dialed: string = await new Promise((resolve: (v: string) => void) => {
+      lookup(
+        "api.anthropic.com",
+        { all: false },
+        (_error: Error | null, address: string) => {
+          resolve(address);
+        },
+      );
+    });
+
+    expect(dialed).toBe("93.184.216.34");
+  });
+
+  test("the guard resolves once per completion, not once per retry", async () => {
+    /*
+     * postOpenAIChatCompletion re-posts when the provider rejects a generation
+     * parameter. Re-resolving per attempt would add a fresh rebind window
+     * between attempts.
+     */
+    await LLMService.getCompletion({
+      llmProviderConfig: {
+        llmType: LlmType.OpenAICompatible,
+        apiKey: "sk-secret",
+        modelName: "some-model",
+        baseUrl: "https://gateway.example.com/v1",
+      },
+      messages: [{ role: "user", content: "hi" }],
+    });
+
+    expect(lookupSpy).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("DataSourceEgressGuard self-hosted policy for LLM providers", () => {
+  const resolveToPrivate: EgressResolveFunction = (): Promise<
+    Array<ResolvedAddress>
+  > => {
+    return Promise.resolve([{ address: "10.0.0.5", family: 4 }]);
+  };
+
+  test("a self-hosted Ollama on a private address is still reachable", async () => {
+    // The documented deployment: blockPrivateAddresses off (no billing).
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowed("http://ollama.internal:11434", {
+        blockPrivateAddresses: false,
+        resolveFunction: resolveToPrivate,
+        targetLabel: "LLM provider",
+      }),
+    ).resolves.toBeDefined();
+  });
+
+  test("but loopback and link-local are blocked even self-hosted", async () => {
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowed("http://127.0.0.1:11434", {
+        blockPrivateAddresses: false,
+        targetLabel: "LLM provider",
+      }),
+    ).rejects.toThrow();
+
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowed("http://169.254.169.254/", {
+        blockPrivateAddresses: false,
+        targetLabel: "LLM provider",
+      }),
+    ).rejects.toThrow();
+  });
+});

package/Tests/Server/Utils/AI/LLMServiceModelCompatibility.test.ts

@@ -1,4 +1,5 @@
 import API from "../../../../Utils/API";
+import stubLLMEgressGuard from "./StubLLMEgressGuard";
 import logger from "../../../../Server/Utils/Logger";
 import HTTPErrorResponse from "../../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../../Types/API/HTTPResponse";
@@ -90,6 +91,8 @@ function bodyOf(spy: PostSpy, callIndex: number): JSONObject {
 }
 
 beforeEach(() => {
+  // These hosts are placeholders; the SSRF guard is covered elsewhere.
+  stubLLMEgressGuard();
   LLMService.clearRequestAdaptationCache();
   jest.spyOn(logger, "debug").mockImplementation((): void => {});
   jest.spyOn(logger, "error").mockImplementation((): void => {});

package/Tests/Server/Utils/AI/LLMServiceRequestPolicy.test.ts

@@ -7,7 +7,8 @@ import LlmType from "../../../../Types/LLM/LlmType";
 import LLMService, {
   LLMProviderConfig,
 } from "../../../../Server/Utils/LLM/LLMService";
-import { afterEach, describe, expect, test } from "@jest/globals";
+import stubLLMEgressGuard from "./StubLLMEgressGuard";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
 
 type PostSpy = ReturnType<typeof jest.spyOn>;
 
@@ -83,6 +84,11 @@ function mockPost(response: JSONObject): PostSpy {
   } as unknown as HTTPResponse<JSONObject>) as PostSpy;
 }
 
+// These hosts are placeholders; the SSRF guard is covered elsewhere.
+beforeEach(() => {
+  stubLLMEgressGuard();
+});
+
 afterEach(() => {
   jest.restoreAllMocks();
 });
@@ -103,11 +109,16 @@ describe("LLMService request timeout and retry policy", () => {
       expect(postSpy).toHaveBeenCalledTimes(1);
       expect(postSpy.mock.calls[0]![0]).toEqual(
         expect.objectContaining({
-          options: {
+          options: expect.objectContaining({
             retries: 0,
             exponentialBackoff: true,
             timeout: 12_345,
-          },
+            /*
+             * Every provider request also carries the SSRF guard's
+             * settings — the policy above must not displace them.
+             */
+            doNotFollowRedirects: true,
+          }),
         }),
       );
     },
@@ -125,11 +136,12 @@ describe("LLMService request timeout and retry policy", () => {
 
       expect(postSpy.mock.calls[0]![0]).toEqual(
         expect.objectContaining({
-          options: {
+          options: expect.objectContaining({
             retries: 2,
             exponentialBackoff: true,
             timeout: defaultTimeoutInMs,
-          },
+            doNotFollowRedirects: true,
+          }),
         }),
       );
     },

package/Tests/Server/Utils/AI/LLMServiceToolCalling.test.ts

@@ -5,7 +5,15 @@ import LlmType from "../../../../Types/LLM/LlmType";
 import LLMService, {
   LLMCompletionResponse,
 } from "../../../../Server/Utils/LLM/LLMService";
-import { afterEach, describe, expect, jest, test } from "@jest/globals";
+import stubLLMEgressGuard from "./StubLLMEgressGuard";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
 
 type PostSpy = ReturnType<typeof jest.spyOn>;
 
@@ -15,6 +23,11 @@ function mockPostResponse(jsonData: JSONObject): PostSpy {
   } as unknown as HTTPResponse<JSONObject>) as PostSpy;
 }
 
+// These hosts are placeholders; the SSRF guard is covered elsewhere.
+beforeEach(() => {
+  stubLLMEgressGuard();
+});
+
 afterEach(() => {
   jest.restoreAllMocks();
 });

package/Tests/Server/Utils/AI/ObservabilityChatPrompt.test.ts

@@ -140,3 +140,38 @@ describe("buildObservabilityChatSystemPrompt with page context", () => {
     expect(prompt).toContain("Cite your sources.");
   });
 });
+
+/*
+ * open_code_pull_request now opens the PR ready for review rather than as a
+ * draft. The system prompt describes that tool to the model in its own words,
+ * so a stale sentence here makes the model tell the user it filed a draft and
+ * that they should go mark it ready — for a PR that already is.
+ *
+ * What must stay is the part that was never about the draft flag: this is a
+ * proposal off the default branch that a human reviews and merges.
+ */
+describe("buildObservabilityChatSystemPrompt — how it describes code changes", () => {
+  const prompt: string = buildObservabilityChatSystemPrompt({
+    currentTime: new Date("2026-07-16T00:00:00Z"),
+    permissionMode: AIChatPermissionMode.AskForApproval,
+  });
+
+  test("does not tell the model the pull request is a draft", () => {
+    expect(prompt.toLowerCase()).not.toContain("draft pull request");
+  });
+
+  test("says the pull request opens ready for review", () => {
+    expect(prompt).toContain("ready for review");
+  });
+
+  test("still says the change goes off the default branch for a human", () => {
+    expect(prompt).toContain("off the default branch");
+    expect(prompt).toContain("for a human to review");
+  });
+
+  test("still prefers open_code_pull_request over committing to a branch", () => {
+    expect(prompt).toContain(
+      "open_code_pull_request is the right tool almost always",
+    );
+  });
+});

package/Tests/Server/Utils/AI/StubLLMEgressGuard.ts

@@ -0,0 +1,25 @@
+import DataSourceEgressGuard from "../../../../Server/Utils/DataSource/EgressGuard";
+import { jest } from "@jest/globals";
+
+/*
+ * LLMService validates and pins every provider URL through the SSRF egress
+ * guard before posting, which means a real DNS lookup for whatever host the
+ * test configured. The suites that are about request SHAPE rather than egress
+ * policy use unresolvable placeholder hosts ("http://host:8000"), so they stub
+ * the guard and stay offline.
+ *
+ * Call this from a beforeEach, before the API.post stub. Egress policy itself
+ * is covered by LLMServiceEgressGuard.test.ts, which does NOT stub it.
+ */
+export default function stubLLMEgressGuard(): void {
+  jest
+    .spyOn(DataSourceEgressGuard, "assertUrlAllowedAndPin")
+    .mockImplementation((urlString: string) => {
+      return Promise.resolve({
+        url: new globalThis.URL(urlString),
+        addresses: [{ address: "93.184.216.34", family: 4 }],
+        httpAgent: undefined as never,
+        httpsAgent: undefined as never,
+      });
+    });
+}

package/Tests/Server/Utils/Dashboard/PublicDashboardResourceListPolicy.test.ts

@@ -694,7 +694,13 @@ describe("PublicDashboardResourceListPolicy", () => {
       );
     });
 
-    it("ignores a forged scalar All value for a stored multi-select", () => {
+    /*
+     * A stored multi-select reads only `selectedValues`. A scalar in the
+     * request is not a narrower selection the viewer is entitled to — it
+     * is a field this variable does not have — so it must not become a
+     * predicate, whatever it contains.
+     */
+    it("ignores a forged scalar value for a stored multi-select", () => {
       const storedVariables: Array<JSONObject> = [
         {
           id: "namespace",
@@ -712,26 +718,75 @@ describe("PublicDashboardResourceListPolicy", () => {
         requestedVariables: [
           {
             id: "namespace",
-            selectedValue: "",
+            selectedValue: "kube-system",
             selectedValues: [],
           },
         ],
       });
-      expect(forgedScalar.query["namespaceKey"]).toBe("production");
+      expect(forgedScalar.query["namespaceKey"]).toBeUndefined();
 
-      const compatiblePlaceholder: PublicDashboardResourceListPolicyResult =
+      const forgedScalarAlongsidePicks: PublicDashboardResourceListPolicyResult =
         build({
           componentType: DashboardComponentType.KubernetesPodList,
           storedVariables,
           requestedVariables: [
             {
               id: "namespace",
-              selectedValue: null,
-              selectedValues: [],
+              selectedValue: "kube-system",
+              selectedValues: ["prod"],
             },
           ],
         });
-      expect(compatiblePlaceholder.query["namespaceKey"]).toBe("production");
+      expect(forgedScalarAlongsidePicks.query["namespaceKey"]).toEqual(
+        new Includes(["prod"]),
+      );
+    });
+
+    /*
+     * The stored `defaultValue` is a single-select concept and never
+     * reaches a multi-select. A viewer who picks nothing — or who clears
+     * the popover, which is the same request on the wire — gets the
+     * unfiltered view the selector is showing them, not the author's
+     * default silently reapplied.
+     */
+    it("treats an empty multi-select as All rather than the stored default", () => {
+      const storedVariables: Array<JSONObject> = [
+        {
+          id: "namespace",
+          name: "Namespace",
+          type: DashboardVariableType.TelemetryAttribute,
+          attributeKey: "k8s.namespace.name",
+          isMultiSelect: true,
+          defaultValue: "production",
+        },
+      ];
+
+      const emptyList: PublicDashboardResourceListPolicyResult = build({
+        componentType: DashboardComponentType.KubernetesPodList,
+        storedVariables,
+        requestedVariables: [
+          {
+            id: "namespace",
+            selectedValue: null,
+            selectedValues: [],
+          },
+        ],
+      });
+      expect(emptyList.query["namespaceKey"]).toBeUndefined();
+
+      const omittedList: PublicDashboardResourceListPolicyResult = build({
+        componentType: DashboardComponentType.KubernetesPodList,
+        storedVariables,
+        requestedVariables: [{ id: "namespace", selectedValue: null }],
+      });
+      expect(omittedList.query["namespaceKey"]).toBeUndefined();
+
+      const noSelectionSent: PublicDashboardResourceListPolicyResult = build({
+        componentType: DashboardComponentType.KubernetesPodList,
+        storedVariables,
+        requestedVariables: [],
+      });
+      expect(noSelectionSent.query["namespaceKey"]).toBeUndefined();
     });
 
     it("ignores stale multi-value input for a stored single-select", () => {

package/Tests/Server/Utils/DataSource/EgressGuard.test.ts

@@ -643,3 +643,72 @@ describe("DataSourceEgressGuard.shouldBlockPrivateAddresses", () => {
     expect(verdict.blocked).toBe(false);
   });
 });
+
+/*
+ * The private-address policy reads BILLING_ENABLED from process.env at call
+ * time (SaaS blocks private ranges; a self-hosted install with billing off
+ * reaches its own 10.x/192.168.x). These tests pin that call-time behaviour so
+ * the two policy inputs (this flag and DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES)
+ * stay consistent and independently controllable.
+ */
+describe("DataSourceEgressGuard.shouldBlockPrivateAddresses - BILLING_ENABLED is read dynamically", () => {
+  const BILLING_ENV: string = "BILLING_ENABLED";
+  let savedBilling: string | undefined = undefined;
+
+  beforeEach(() => {
+    savedBilling = process.env[BILLING_ENV];
+  });
+
+  afterEach(() => {
+    if (savedBilling === undefined) {
+      delete process.env[BILLING_ENV];
+    } else {
+      process.env[BILLING_ENV] = savedBilling;
+    }
+  });
+
+  test("SaaS (BILLING_ENABLED=true) blocks private ranges by default", () => {
+    process.env[BILLING_ENV] = "true";
+    delete process.env[ENV_VAR_NAME];
+    expect(DataSourceEgressGuard.shouldBlockPrivateAddresses()).toBe(true);
+  });
+
+  test("self-hosted (BILLING_ENABLED unset) allows private ranges by default", () => {
+    delete process.env[BILLING_ENV];
+    delete process.env[ENV_VAR_NAME];
+    expect(DataSourceEgressGuard.shouldBlockPrivateAddresses()).toBe(false);
+  });
+
+  test("BILLING_ENABLED with any value other than 'true' counts as off", () => {
+    process.env[BILLING_ENV] = "1";
+    delete process.env[ENV_VAR_NAME];
+    expect(DataSourceEgressGuard.shouldBlockPrivateAddresses()).toBe(false);
+  });
+
+  test("DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES=true blocks even when billing is off", () => {
+    delete process.env[BILLING_ENV];
+    process.env[ENV_VAR_NAME] = "true";
+    expect(DataSourceEgressGuard.shouldBlockPrivateAddresses()).toBe(true);
+  });
+
+  test("checkAddress follows the billing flag when no explicit policy is given", () => {
+    delete process.env[ENV_VAR_NAME];
+
+    process.env[BILLING_ENV] = "true";
+    expect(DataSourceEgressGuard.checkAddress("10.0.0.5").blocked).toBe(true);
+
+    delete process.env[BILLING_ENV];
+    expect(DataSourceEgressGuard.checkAddress("10.0.0.5").blocked).toBe(false);
+  });
+
+  test("a self-hosted install still cannot reach loopback or metadata ranges", () => {
+    delete process.env[BILLING_ENV];
+    delete process.env[ENV_VAR_NAME];
+
+    // Always-blocked ranges ignore the billing flag entirely.
+    expect(DataSourceEgressGuard.checkAddress("127.0.0.1").blocked).toBe(true);
+    expect(DataSourceEgressGuard.checkAddress("169.254.169.254").blocked).toBe(
+      true,
+    );
+  });
+});