@oneuptime/common 12.0.6 → 12.0.7

package/Tests/Types/AI/AIChatMessageStatus.test.ts

@@ -0,0 +1,79 @@
+import AIChatMessageStatus, {
+  AIChatMessageStatusHelper,
+} from "../../../Types/AI/AIChatMessageStatus";
+
+describe("AIChatMessageStatusHelper", () => {
+  const allStatuses: Array<AIChatMessageStatus> =
+    Object.values(AIChatMessageStatus);
+
+  describe("isTerminalStatus", () => {
+    test("Completed and Error are terminal", () => {
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(
+          AIChatMessageStatus.Completed,
+        ),
+      ).toBe(true);
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(AIChatMessageStatus.Error),
+      ).toBe(true);
+    });
+
+    test("in-flight statuses are not terminal", () => {
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(AIChatMessageStatus.Pending),
+      ).toBe(false);
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(
+          AIChatMessageStatus.InProgress,
+        ),
+      ).toBe(false);
+      expect(
+        AIChatMessageStatusHelper.isTerminalStatus(
+          AIChatMessageStatus.WaitingForApproval,
+        ),
+      ).toBe(false);
+    });
+  });
+
+  describe("isActiveStatus", () => {
+    test("Pending, InProgress and WaitingForApproval are active", () => {
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(AIChatMessageStatus.Pending),
+      ).toBe(true);
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(
+          AIChatMessageStatus.InProgress,
+        ),
+      ).toBe(true);
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(
+          AIChatMessageStatus.WaitingForApproval,
+        ),
+      ).toBe(true);
+    });
+
+    test("terminal statuses are not active", () => {
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(AIChatMessageStatus.Completed),
+      ).toBe(false);
+      expect(
+        AIChatMessageStatusHelper.isActiveStatus(AIChatMessageStatus.Error),
+      ).toBe(false);
+    });
+  });
+
+  test("active and terminal are mutually exclusive and jointly exhaustive", () => {
+    /*
+     * Every status must be exactly one of active or terminal — a status that
+     * is neither would hang a spinner forever; one that is both is a
+     * contradiction. This guards against a new enum member being added
+     * without wiring it into both predicates.
+     */
+    for (const status of allStatuses) {
+      const active: boolean = AIChatMessageStatusHelper.isActiveStatus(status);
+      const terminal: boolean =
+        AIChatMessageStatusHelper.isTerminalStatus(status);
+      expect(active).not.toBe(terminal);
+    }
+  });
+});

package/Tests/Types/AI/AIInsightStatus.test.ts

@@ -0,0 +1,40 @@
+import AIInsightStatus, {
+  AIInsightStatusHelper,
+} from "../../../Types/AI/AIInsightStatus";
+
+describe("AIInsightStatusHelper.isTerminalStatus", () => {
+  test("the two human end states are terminal", () => {
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.Resolved),
+    ).toBe(true);
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.Dismissed),
+    ).toBe(true);
+  });
+
+  test("the scanner-owned lifecycle states are not terminal", () => {
+    /*
+     * Detected/ActionRequired/FixOpened are the states a detector may still
+     * refresh (dedupe into). If any were treated as terminal the scanner
+     * would stop updating a live insight.
+     */
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.Detected),
+    ).toBe(false);
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.ActionRequired),
+    ).toBe(false);
+    expect(
+      AIInsightStatusHelper.isTerminalStatus(AIInsightStatus.FixOpened),
+    ).toBe(false);
+  });
+
+  test("exactly two of the five statuses are terminal", () => {
+    const terminalCount: number = Object.values(AIInsightStatus).filter(
+      (status: AIInsightStatus) => {
+        return AIInsightStatusHelper.isTerminalStatus(status);
+      },
+    ).length;
+    expect(terminalCount).toBe(2);
+  });
+});

package/Tests/Types/API/HostnameAuthorityParsing.test.ts

@@ -0,0 +1,157 @@
+import Hostname from "../../../Types/API/Hostname";
+import URL from "../../../Types/API/URL";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Hostname used to validate with a character allowlist that happened to
+ * include "/", "?", "#" and "@". Anything that stores a Hostname and later
+ * interpolates it into a URL therefore inherited control of the host, port
+ * AND path of the resulting request — which is how a status page subdomain of
+ * "169.254.169.254/latest/meta-data/#" became a request to the cloud metadata
+ * endpoint. These tests pin the structural rules that replaced it, and the
+ * matching fix in URL.fromString, which used to leave a query string glued to
+ * the host.
+ */
+
+describe("Hostname.isValid accepts real hosts", () => {
+  const validHostnames: Array<string> = [
+    "localhost",
+    "localhost:5000",
+    "example.com",
+    "status.example.com",
+    "deep.sub.domain.example.com",
+    "example.com.",
+    "EXAMPLE.com",
+    "my-host.internal",
+    "host_with_underscore.internal",
+    "_dmarc.example.com",
+    "1.2.3.4",
+    "1.2.3.4:8080",
+    "smtp.example.com:587",
+    "[::1]",
+    "[::1]:8080",
+    "[2606:2800:220:1:248:1893:25c8:1946]:443",
+    "::1",
+    "2606:2800:220:1:248:1893:25c8:1946",
+    // Userinfo is still accepted: it is already in customers' stored URLs.
+    "user:token@hooks.example.com",
+    "user@hooks.example.com",
+    "user:token@hooks.example.com:8443",
+  ];
+
+  test.each(validHostnames)("accepts %s", (hostname: string) => {
+    expect(Hostname.isValid(hostname)).toBe(true);
+  });
+});
+
+describe("Hostname.isValid rejects smuggled paths, queries and fragments", () => {
+  const invalidHostnames: Array<string> = [
+    // The status page / dashboard subdomain injection.
+    "169.254.169.254/latest/meta-data/#",
+    "169.254.169.254/latest/meta-data/#.example.com",
+    "example.com/../../etc/passwd",
+    "example.com/path",
+    "example.com?query=1",
+    "example.com#fragment",
+    "example.com:8080/path",
+    // Junk the old character allowlist waved through.
+    "example.com;evil",
+    "example.com,evil",
+    "exa mple.com",
+    "undefined undefined",
+    "localhost 5000",
+    "",
+    "   ",
+    // A port that is not a port.
+    "example.com:notaport",
+    "example.com:80:90",
+    // Hyphen placement.
+    "-example.com",
+    "example-.com",
+    // Userinfo may not itself carry a path or a second authority.
+    "user@evil.com/@example.com",
+    "user@example.com?x=1",
+  ];
+
+  test.each(invalidHostnames)("rejects %s", (hostname: string) => {
+    expect(Hostname.isValid(hostname)).toBe(false);
+  });
+
+  test("the constructor throws rather than storing a smuggled value", () => {
+    expect(() => {
+      return new Hostname("169.254.169.254/latest/meta-data/#");
+    }).toThrow(BadDataException);
+  });
+});
+
+describe("URL.fromString keeps the authority separate from the rest", () => {
+  test("a query string on a path-less URL does not end up in the host", () => {
+    const url: URL = URL.fromString("https://hooks.example.com?token=abc");
+
+    expect(url.hostname.hostname).toBe("hooks.example.com");
+    expect(url.getQueryParam("token")).toBe("abc");
+  });
+
+  test("a fragment on a path-less URL does not end up in the host", () => {
+    const url: URL = URL.fromString("https://hooks.example.com#section");
+
+    expect(url.hostname.hostname).toBe("hooks.example.com");
+  });
+
+  test("a path still parses as a route", () => {
+    const url: URL = URL.fromString("https://hooks.example.com/a/b?x=1");
+
+    expect(url.hostname.hostname).toBe("hooks.example.com");
+    expect(url.route.toString()).toBe("a/b");
+    expect(url.getQueryParam("x")).toBe("1");
+    expect(url.toString()).toBe("https://hooks.example.com/a/b?x=1");
+  });
+
+  test("an upper-case scheme is stripped, not left in the authority", () => {
+    /*
+     * Schemes are case-insensitive. Matching the literal lower-case prefix
+     * left "HTTPS://" in place, so the authority read as "HTTPS:" — which
+     * the old permissive host check waved through and the structural one
+     * (correctly) refuses, turning a valid webhook URL into an error.
+     */
+    const url: URL = URL.fromString("HTTPS://hooks.example.com/webhook");
+
+    expect(url.hostname.hostname).toBe("hooks.example.com");
+    expect(url.protocol.toString()).toBe("https://");
+  });
+
+  test("a host with a port survives", () => {
+    const url: URL = URL.fromString("http://localhost:5000/api/test");
+
+    expect(url.hostname.toString()).toBe("localhost:5000");
+    expect(url.toString()).toBe("http://localhost:5000/api/test");
+  });
+
+  test("a mailto address is parsed as an email, not as a host", () => {
+    const url: URL = URL.fromString("mailto:support@oneuptime.com");
+
+    expect(url.email.toString()).toBe("support@oneuptime.com");
+    expect(url.toString()).toBe("mailto:support@oneuptime.com");
+  });
+
+  test("a mailto address with a subject does not go through the host validator", () => {
+    const url: URL = URL.fromString(
+      "mailto:support@oneuptime.com?subject=Hello",
+    );
+
+    expect(url.email.toString()).toBe("support@oneuptime.com");
+    expect(url.getQueryParam("subject")).toBe("Hello");
+  });
+
+  test("a webhook URL with basic-auth credentials still round-trips", () => {
+    /*
+     * These are already in customers' databases. Rejecting them here would
+     * fail on read, not just on write.
+     */
+    const url: URL = URL.fromString("https://user:token@hooks.example.com/x");
+
+    expect(url.hostname.hostname).toBe("user:token@hooks.example.com");
+    expect(url.toString()).toBe("https://user:token@hooks.example.com/x");
+  });
+});

package/Tests/Types/Dashboard/DashboardTemplateInvariants.test.ts

@@ -767,6 +767,33 @@ describe("DashboardTemplates invariants (all templates)", () => {
       }
     });
 
+    /*
+     * A multi-select variable resolves from its picks alone, and starts
+     * with none — so it opens on "All" and `defaultValue` never applies
+     * (see DashboardVariableInterpolation.resolveValue). A template that
+     * shipped one would look like it scoped its widgets and would not.
+     * Templates that want an opening scope must use a single-select.
+     */
+    test("no template ships a multi-select variable with a default", (): void => {
+      const offenders: Array<string> = [];
+      let multiSelectVariables: number = 0;
+
+      for (const loaded of loadAllTemplates()) {
+        for (const variable of loaded.config.variables || []) {
+          if (!variable.isMultiSelect) {
+            continue;
+          }
+          multiSelectVariables++;
+          if ((variable.defaultValue ?? "").length > 0) {
+            offenders.push(`${loaded.type} variable "${variable.name}"`);
+          }
+        }
+      }
+
+      expect(multiSelectVariables).toBeGreaterThan(0);
+      expect(offenders).toEqual([]);
+    });
+
     test("variable ids are freshly generated on every call", (): void => {
       const typesWithVariables: Array<DashboardTemplateType> =
         TEMPLATE_TYPES_WITH_CONFIG.filter(

package/Tests/Types/DataSource/DataSourceLimits.test.ts

@@ -0,0 +1,71 @@
+import {
+  DATA_SOURCE_MAX_STEP_IN_SECONDS,
+  DATA_SOURCE_MIN_STEP_IN_SECONDS,
+  DATA_SOURCE_TARGET_BUCKETS,
+  DataSourceLimitsUtil,
+} from "../../../Types/DataSource/DataSourceLimits";
+
+describe("DataSourceLimitsUtil.getStepInSeconds", () => {
+  const stepFor: (seconds: number) => number = (seconds: number): number => {
+    const start: Date = new Date("2026-01-01T00:00:00.000Z");
+    const end: Date = new Date(start.getTime() + seconds * 1000);
+    return DataSourceLimitsUtil.getStepInSeconds(start, end);
+  };
+
+  test("aims for ~TARGET_BUCKETS buckets across the window", () => {
+    // A one-hour window / 250 buckets = 14.4s, ceil -> 15s.
+    expect(stepFor(60 * 60)).toBe(15);
+
+    // A 24-hour window / 250 = 345.6s, ceil -> 346s.
+    expect(stepFor(24 * 60 * 60)).toBe(346);
+  });
+
+  test("never returns a step below MIN_STEP for short windows", () => {
+    // A tiny window would compute a sub-second step; it is clamped up.
+    expect(stepFor(60)).toBe(DATA_SOURCE_MIN_STEP_IN_SECONDS);
+    expect(stepFor(1)).toBe(DATA_SOURCE_MIN_STEP_IN_SECONDS);
+  });
+
+  test("the MIN_STEP boundary is exact, not off-by-one", () => {
+    /*
+     * rawStep = ceil(range / TARGET_BUCKETS). The largest range whose rawStep
+     * still equals MIN_STEP is MIN_STEP * TARGET_BUCKETS seconds. One second
+     * more must tip rawStep to MIN_STEP + 1.
+     */
+    const atBoundary: number =
+      DATA_SOURCE_MIN_STEP_IN_SECONDS * DATA_SOURCE_TARGET_BUCKETS;
+    expect(stepFor(atBoundary)).toBe(DATA_SOURCE_MIN_STEP_IN_SECONDS);
+    expect(stepFor(atBoundary + 1)).toBe(DATA_SOURCE_MIN_STEP_IN_SECONDS + 1);
+  });
+
+  test("never returns a step above MAX_STEP for huge windows", () => {
+    // A one-year window would compute a far larger step; it is clamped down.
+    expect(stepFor(365 * 24 * 60 * 60)).toBe(DATA_SOURCE_MAX_STEP_IN_SECONDS);
+  });
+
+  test("a zero-length window is treated as at least one second", () => {
+    const instant: Date = new Date("2026-01-01T00:00:00.000Z");
+    // range floors to >=1s, so the step is the clamped minimum, never 0.
+    expect(DataSourceLimitsUtil.getStepInSeconds(instant, instant)).toBe(
+      DATA_SOURCE_MIN_STEP_IN_SECONDS,
+    );
+  });
+
+  test("an inverted range (end before start) still yields a sane minimum", () => {
+    // Guards against a negative step reaching a downstream range query.
+    const start: Date = new Date("2026-01-01T12:00:00.000Z");
+    const end: Date = new Date("2026-01-01T00:00:00.000Z");
+    expect(DataSourceLimitsUtil.getStepInSeconds(start, end)).toBe(
+      DATA_SOURCE_MIN_STEP_IN_SECONDS,
+    );
+  });
+
+  test("the returned step is always a whole number within bounds", () => {
+    for (const seconds of [1, 90, 3600, 86400, 7 * 86400, 400 * 86400]) {
+      const step: number = stepFor(seconds);
+      expect(Number.isInteger(step)).toBe(true);
+      expect(step).toBeGreaterThanOrEqual(DATA_SOURCE_MIN_STEP_IN_SECONDS);
+      expect(step).toBeLessThanOrEqual(DATA_SOURCE_MAX_STEP_IN_SECONDS);
+    }
+  });
+});

package/Tests/Types/DataSource/DataSourceType.test.ts

@@ -0,0 +1,181 @@
+import DataSourceType, {
+  DataSourceTypeCategories,
+  DataSourceTypeCategory,
+  DataSourceTypeProps,
+  DataSourceTypeUtil,
+} from "../../../Types/DataSource/DataSourceType";
+
+describe("DataSourceTypeUtil", () => {
+  describe("getAllDataSourceTypes", () => {
+    test("returns every declared DataSourceType exactly once", () => {
+      const all: Array<DataSourceType> =
+        DataSourceTypeUtil.getAllDataSourceTypes();
+
+      // Must match the enum members one-for-one — no missing, no duplicates.
+      const enumMembers: Array<DataSourceType> = Object.values(DataSourceType);
+      expect([...all].sort()).toEqual([...enumMembers].sort());
+      expect(new Set(all).size).toBe(all.length);
+    });
+
+    test("returns a fresh array each call (callers may mutate it)", () => {
+      const first: Array<DataSourceType> =
+        DataSourceTypeUtil.getAllDataSourceTypes();
+      const second: Array<DataSourceType> =
+        DataSourceTypeUtil.getAllDataSourceTypes();
+      expect(first).not.toBe(second);
+      expect(first).toEqual(second);
+    });
+  });
+
+  describe("isHttpBasedType / isDatabaseType partition", () => {
+    test("every type is exactly one of HTTP-based or database", () => {
+      for (const type of DataSourceTypeUtil.getAllDataSourceTypes()) {
+        const http: boolean = DataSourceTypeUtil.isHttpBasedType(type);
+        const db: boolean = DataSourceTypeUtil.isDatabaseType(type);
+        // Exactly one of the two must be true — they partition the set.
+        expect(http).not.toEqual(db);
+      }
+    });
+
+    test("HTTP-based types are the metrics/logs/search/api connectors", () => {
+      expect(
+        DataSourceTypeUtil.isHttpBasedType(DataSourceType.Prometheus),
+      ).toBe(true);
+      expect(DataSourceTypeUtil.isHttpBasedType(DataSourceType.Loki)).toBe(
+        true,
+      );
+      expect(
+        DataSourceTypeUtil.isHttpBasedType(DataSourceType.Elasticsearch),
+      ).toBe(true);
+      expect(DataSourceTypeUtil.isHttpBasedType(DataSourceType.RestApi)).toBe(
+        true,
+      );
+      expect(
+        DataSourceTypeUtil.isHttpBasedType(DataSourceType.PostgreSQL),
+      ).toBe(false);
+    });
+
+    test("database types are the SQL-driver connectors", () => {
+      expect(DataSourceTypeUtil.isDatabaseType(DataSourceType.PostgreSQL)).toBe(
+        true,
+      );
+      expect(DataSourceTypeUtil.isDatabaseType(DataSourceType.MySQL)).toBe(
+        true,
+      );
+      expect(
+        DataSourceTypeUtil.isDatabaseType(DataSourceType.MicrosoftSqlServer),
+      ).toBe(true);
+      expect(DataSourceTypeUtil.isDatabaseType(DataSourceType.ClickHouse)).toBe(
+        true,
+      );
+      expect(DataSourceTypeUtil.isDatabaseType(DataSourceType.Prometheus)).toBe(
+        false,
+      );
+    });
+  });
+
+  describe("getDefaultPort", () => {
+    test("database types seed the well-known driver port", () => {
+      expect(DataSourceTypeUtil.getDefaultPort(DataSourceType.PostgreSQL)).toBe(
+        5432,
+      );
+      expect(DataSourceTypeUtil.getDefaultPort(DataSourceType.MySQL)).toBe(
+        3306,
+      );
+      expect(
+        DataSourceTypeUtil.getDefaultPort(DataSourceType.MicrosoftSqlServer),
+      ).toBe(1433);
+      // ClickHouse is queried over its HTTP interface, not the native 9000.
+      expect(DataSourceTypeUtil.getDefaultPort(DataSourceType.ClickHouse)).toBe(
+        8123,
+      );
+    });
+
+    test("HTTP-based types have no default port (they carry a full URL)", () => {
+      expect(
+        DataSourceTypeUtil.getDefaultPort(DataSourceType.Prometheus),
+      ).toBeNull();
+      expect(DataSourceTypeUtil.getDefaultPort(DataSourceType.Loki)).toBeNull();
+      expect(
+        DataSourceTypeUtil.getDefaultPort(DataSourceType.Elasticsearch),
+      ).toBeNull();
+      expect(
+        DataSourceTypeUtil.getDefaultPort(DataSourceType.RestApi),
+      ).toBeNull();
+    });
+
+    test("a default port is defined for exactly the database types", () => {
+      for (const type of DataSourceTypeUtil.getAllDataSourceTypes()) {
+        const hasPort: boolean =
+          DataSourceTypeUtil.getDefaultPort(type) !== null;
+        expect(hasPort).toBe(DataSourceTypeUtil.isDatabaseType(type));
+      }
+    });
+  });
+
+  describe("getProps", () => {
+    test("every type gets self-consistent, non-empty display props", () => {
+      for (const type of DataSourceTypeUtil.getAllDataSourceTypes()) {
+        const props: DataSourceTypeProps = DataSourceTypeUtil.getProps(type);
+
+        // The props describe the very type they were requested for.
+        expect(props.dataSourceType).toBe(type);
+        expect(props.title.length).toBeGreaterThan(0);
+        expect(props.description.length).toBeGreaterThan(0);
+        expect(props.queryLanguageTitle.length).toBeGreaterThan(0);
+        expect(props.queryPlaceholder.length).toBeGreaterThan(0);
+        // The category must be one the picker knows how to render.
+        expect(DataSourceTypeCategories).toContain(props.category);
+      }
+    });
+
+    test("getCategory agrees with getProps().category", () => {
+      for (const type of DataSourceTypeUtil.getAllDataSourceTypes()) {
+        expect(DataSourceTypeUtil.getCategory(type)).toBe(
+          DataSourceTypeUtil.getProps(type).category,
+        );
+      }
+    });
+
+    test("all four database types are categorised as Databases", () => {
+      for (const type of DataSourceTypeUtil.getAllDataSourceTypes()) {
+        if (DataSourceTypeUtil.isDatabaseType(type)) {
+          expect(DataSourceTypeUtil.getCategory(type)).toBe(
+            DataSourceTypeCategory.Databases,
+          );
+        }
+      }
+    });
+
+    test("the connector categories land in their expected sections", () => {
+      expect(DataSourceTypeUtil.getCategory(DataSourceType.Prometheus)).toBe(
+        DataSourceTypeCategory.Metrics,
+      );
+      expect(DataSourceTypeUtil.getCategory(DataSourceType.Loki)).toBe(
+        DataSourceTypeCategory.Logs,
+      );
+      expect(DataSourceTypeUtil.getCategory(DataSourceType.Elasticsearch)).toBe(
+        DataSourceTypeCategory.Search,
+      );
+      expect(DataSourceTypeUtil.getCategory(DataSourceType.RestApi)).toBe(
+        DataSourceTypeCategory.Api,
+      );
+    });
+  });
+
+  describe("DataSourceTypeCategories ordering", () => {
+    test("lists every category once, in the picker's display order", () => {
+      expect(DataSourceTypeCategories).toEqual([
+        DataSourceTypeCategory.Metrics,
+        DataSourceTypeCategory.Logs,
+        DataSourceTypeCategory.Databases,
+        DataSourceTypeCategory.Search,
+        DataSourceTypeCategory.Api,
+      ]);
+      // No category is missing and none is listed twice.
+      expect(new Set(DataSourceTypeCategories).size).toBe(
+        Object.values(DataSourceTypeCategory).length,
+      );
+    });
+  });
+});

package/Tests/Types/DomainSubdomainValidation.test.ts

@@ -0,0 +1,90 @@
+import Domain from "../../Types/Domain";
+import URL from "../../Types/API/URL";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * StatusPageDomain.subdomain and DashboardDomain.subdomain are ShortText that
+ * used to be trimmed and lower-cased and nothing else. Both services build
+ * fullDomain as `${subdomain}.${baseDomain}` and then interpolate it into
+ * "https://" + fullDomain + "/status-page-api/...", which the certificate
+ * cron fetches unattended every 15 minutes. Because URL parsing takes
+ * everything before the first "/" as the host, a subdomain carrying a "/"
+ * gave an attacker the host, the port and the path of that request.
+ */
+
+describe("Domain.isValidSubdomain accepts ordinary subdomains", () => {
+  const valid: Array<string> = [
+    "status",
+    "dashboard",
+    "status-page",
+    "eu-west-1",
+    "a",
+    "status.eu",
+    "deep.nested.label",
+    "s1",
+    "1status",
+  ];
+
+  test.each(valid)("accepts %s", (subdomain: string) => {
+    expect(Domain.isValidSubdomain(subdomain)).toBe(true);
+  });
+});
+
+describe("Domain.isValidSubdomain rejects anything that is not a DNS label", () => {
+  const invalid: Array<string> = [
+    // The metadata-endpoint injection this exists to stop.
+    "169.254.169.254/latest/meta-data/#",
+    "169.254.169.254/latest/meta-data/iam/security-credentials/#",
+    "status/../../admin",
+    "status/path",
+    // Scheme, port, credentials, query, fragment.
+    "http://169.254.169.254",
+    "169.254.169.254:80",
+    "user@169.254.169.254",
+    "status?x=1",
+    "status#frag",
+    "status\\evil",
+    // Structural junk.
+    "-status",
+    "status-",
+    "sta tus",
+    "",
+    "@",
+    ".",
+    "status..double",
+    ".status",
+    "status.",
+  ];
+
+  test.each(invalid)("rejects %s", (subdomain: string) => {
+    expect(Domain.isValidSubdomain(subdomain)).toBe(false);
+  });
+
+  test("rejects a label longer than 63 characters", () => {
+    expect(Domain.isValidSubdomain("a".repeat(63))).toBe(true);
+    expect(Domain.isValidSubdomain("a".repeat(64))).toBe(false);
+  });
+});
+
+describe("the injection this blocks, end to end", () => {
+  test("an unvalidated subdomain would have redirected the cert check to metadata", () => {
+    /*
+     * Demonstrates why a subdomain check is the fix rather than trusting the
+     * URL builder: with the malicious label in place, the host of the
+     * resulting URL is the metadata endpoint and the base domain has been
+     * demoted into the path.
+     */
+    const maliciousSubdomain: string = "169.254.169.254/latest/meta-data/#";
+    const baseDomain: string = "example.com";
+    const fullDomain: string = `${maliciousSubdomain}.${baseDomain}`;
+
+    const url: URL = URL.fromString(
+      "https://" + fullDomain + "/status-page-api/cname-verification/token",
+    );
+
+    expect(url.hostname.hostname).toBe("169.254.169.254");
+
+    // And the validator refuses to let that subdomain be stored at all.
+    expect(Domain.isValidSubdomain(maliciousSubdomain)).toBe(false);
+  });
+});