@oneuptime/common 12.0.6 → 12.0.8

package/Tests/App/StatusPage/StatusPageDetailPagesNotFound.test.tsx

@@ -0,0 +1,308 @@
+import "@testing-library/jest-dom";
+import { render, screen, waitFor } from "@testing-library/react";
+import React, { act } from "react";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import AnnouncementDetail from "../../../../App/FeatureSet/StatusPage/src/Pages/Announcement/Detail";
+import IncidentDetail from "../../../../App/FeatureSet/StatusPage/src/Pages/Incidents/Detail";
+import ScheduledEventDetail from "../../../../App/FeatureSet/StatusPage/src/Pages/ScheduledEvent/Detail";
+import Route from "../../../Types/API/Route";
+import HTTPErrorResponse from "../../../Types/API/HTTPErrorResponse";
+import HTTPResponse from "../../../Types/API/HTTPResponse";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import LocalStorage from "../../../UI/Utils/LocalStorage";
+import Navigation from "../../../UI/Utils/Navigation";
+
+const STATUS_PAGE_ID: string = "33333333-3333-4333-8333-333333333333";
+const ITEM_ID: string = "44444444-4444-4444-8444-444444444444";
+
+type PostResponse = HTTPResponse<JSONObject> | HTTPErrorResponse;
+type RespondToPostFunction = (url: string) => PostResponse;
+
+/*
+ * Each test swaps this out to describe what the status page API returns for the
+ * request the page under test makes.
+ */
+let mockRespondToPost: RespondToPostFunction = (): PostResponse => {
+  throw new Error("mockRespondToPost was not set by the test");
+};
+
+let mockLogoutCallCount: number = 0;
+
+// Logging out hits the network and navigates, neither of which belongs in this test.
+jest.mock("../../../../App/FeatureSet/StatusPage/src/Utils/User", () => {
+  return {
+    __esModule: true,
+    default: {
+      isLoggedIn: () => {
+        return true;
+      },
+      logout: () => {
+        mockLogoutCallCount++;
+        return Promise.resolve();
+      },
+    },
+  };
+});
+
+jest.mock("../../../../App/FeatureSet/StatusPage/src/Utils/API", () => {
+  return {
+    __esModule: true,
+    default: {
+      post: (options: { url: { toString: () => string } }) => {
+        return Promise.resolve(mockRespondToPost(options.url.toString()));
+      },
+      getDefaultHeaders: () => {
+        return {};
+      },
+      getFriendlyMessage: (error: { message?: string }) => {
+        return error?.message || "Something went wrong";
+      },
+    },
+  };
+});
+
+/*
+ * The real page chrome renders breadcrumb links, which need a router. None of
+ * these tests are about the chrome, so keep it to a plain wrapper.
+ */
+jest.mock(
+  "../../../../App/FeatureSet/StatusPage/src/Components/Page/Page",
+  () => {
+    return {
+      __esModule: true,
+      default: (props: { children: React.ReactNode }) => {
+        return <div>{props.children}</div>;
+      },
+    };
+  },
+);
+
+type SuccessResponseFunction = (data: JSONObject) => HTTPResponse<JSONObject>;
+
+const successResponse: SuccessResponseFunction = (
+  data: JSONObject,
+): HTTPResponse<JSONObject> => {
+  return new HTTPResponse<JSONObject>(200, data, {});
+};
+
+type ErrorResponseFunction = (
+  statusCode: number,
+  message: string,
+) => HTTPErrorResponse;
+
+const errorResponse: ErrorResponseFunction = (
+  statusCode: number,
+  message: string,
+): HTTPErrorResponse => {
+  return new HTTPErrorResponse(statusCode, { message: message }, {});
+};
+
+type PageComponent = React.FunctionComponent<{
+  pageRoute: Route;
+  onLoadComplete: () => void;
+}>;
+
+type RenderPageFunction = (
+  Component: PageComponent,
+) => Promise<ReturnType<typeof render>>;
+
+/*
+ * These pages load themselves from an effect, so the render has to be flushed
+ * inside act() for the resulting state updates to be settled.
+ */
+const renderPage: RenderPageFunction = async (
+  Component: PageComponent,
+): Promise<ReturnType<typeof render>> => {
+  let result: ReturnType<typeof render> | null = null;
+
+  await act(async () => {
+    result = render(
+      <Component
+        pageRoute={new Route(`/incidents/${ITEM_ID}`)}
+        onLoadComplete={() => {}}
+      />,
+    );
+  });
+
+  return result!;
+};
+
+describe("Status page detail pages when the item is not available", () => {
+  const navigate: typeof Navigation.navigate = Navigation.navigate;
+
+  beforeEach(() => {
+    mockLogoutCallCount = 0;
+    localStorage.clear();
+    LocalStorage.setItem("statusPageId", new ObjectID(STATUS_PAGE_ID));
+    window.history.replaceState({}, "", `/incidents/${ITEM_ID}`);
+
+    // jsdom cannot leave the page, and it logs a noisy error when asked to.
+    Navigation.navigate = (): void => {};
+  });
+
+  afterEach(() => {
+    Navigation.navigate = navigate;
+    jest.clearAllMocks();
+  });
+
+  test("incident page shows the empty state when neither an incident nor an episode is found", async () => {
+    /*
+     * This is the production case that hung the page: the incident exists but has
+     * no monitors on this status page, so the API filters it out and returns an
+     * empty list with a 200.
+     */
+    mockRespondToPost = (url: string): PostResponse => {
+      if (url.includes("/incidents/")) {
+        return successResponse({
+          incidents: [],
+          incidentPublicNotes: [],
+          incidentStateTimelines: [],
+          statusPageResources: [],
+          monitorsInGroup: {},
+        });
+      }
+
+      // Most status pages have episodes turned off, so the fallback lookup fails.
+      return errorResponse(
+        400,
+        "Episodes are not enabled on this status page.",
+      );
+    };
+
+    const { container } = await renderPage(IncidentDetail);
+
+    await waitFor(() => {
+      expect(container.querySelector("#item-empty-state")).toBeInTheDocument();
+    });
+
+    expect(
+      screen.getByText("Incident not found on this status page."),
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId("bar-loader")).not.toBeInTheDocument();
+
+    // The episode fallback's error is an implementation detail. It must not leak.
+    expect(
+      screen.queryByText("Episodes are not enabled on this status page."),
+    ).not.toBeInTheDocument();
+  });
+
+  test("incident page surfaces the error when the incident lookup itself fails", async () => {
+    mockRespondToPost = (): PostResponse => {
+      return errorResponse(403, "This status page is not public.");
+    };
+
+    const { container } = await renderPage(IncidentDetail);
+
+    await waitFor(() => {
+      expect(
+        screen.getByText("This status page is not public."),
+      ).toBeInTheDocument();
+    });
+
+    expect(
+      container.querySelector("#item-empty-state"),
+    ).not.toBeInTheDocument();
+    expect(screen.queryByTestId("bar-loader")).not.toBeInTheDocument();
+  });
+
+  test("incident page logs the user out when the lookup comes back unauthorized", async () => {
+    // An expired session has to reach the auth check rather than read as "not found".
+    mockRespondToPost = (): PostResponse => {
+      return errorResponse(401, "Not authorized.");
+    };
+
+    await renderPage(IncidentDetail);
+
+    await waitFor(() => {
+      expect(mockLogoutCallCount).toBeGreaterThan(0);
+    });
+  });
+
+  test("incident page still renders the incident when one is found", async () => {
+    mockRespondToPost = (url: string): PostResponse => {
+      if (url.includes("/incidents/")) {
+        return successResponse({
+          incidents: [
+            {
+              _id: ITEM_ID,
+              title: "Checkout is degraded",
+            },
+          ],
+          incidentPublicNotes: [],
+          incidentStateTimelines: [],
+          statusPageResources: [],
+          monitorsInGroup: {},
+        });
+      }
+
+      throw new Error("The episode fallback should not be reached");
+    };
+
+    const { container } = await renderPage(IncidentDetail);
+
+    await waitFor(() => {
+      expect(screen.getByText("Checkout is degraded")).toBeInTheDocument();
+    });
+
+    expect(
+      container.querySelector("#item-empty-state"),
+    ).not.toBeInTheDocument();
+    expect(screen.queryByTestId("bar-loader")).not.toBeInTheDocument();
+  });
+
+  test("scheduled maintenance page shows the empty state when the event is not found", async () => {
+    mockRespondToPost = (): PostResponse => {
+      return successResponse({
+        scheduledMaintenanceEvents: [],
+        scheduledMaintenanceEventsPublicNotes: [],
+        scheduledMaintenanceStateTimelines: [],
+        statusPageResources: [],
+        monitorsInGroup: {},
+      });
+    };
+
+    const { container } = await renderPage(ScheduledEventDetail);
+
+    await waitFor(() => {
+      expect(
+        container.querySelector("#scheduled-event-empty-state"),
+      ).toBeInTheDocument();
+    });
+
+    expect(
+      screen.getByText("No scheduled event found for this status page."),
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId("bar-loader")).not.toBeInTheDocument();
+  });
+
+  test("announcement page shows the empty state when the announcement is not found", async () => {
+    mockRespondToPost = (): PostResponse => {
+      return successResponse({
+        announcements: [],
+        statusPageResources: [],
+        monitorsInGroup: {},
+      });
+    };
+
+    const { container } = await renderPage(AnnouncementDetail);
+
+    await waitFor(() => {
+      expect(
+        container.querySelector("#announcement-empty-state"),
+      ).toBeInTheDocument();
+    });
+
+    expect(
+      screen.getByText("Announcement not found on this status page."),
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId("bar-loader")).not.toBeInTheDocument();
+  });
+});

package/Tests/Models/DatabaseModels/DeletedProjectModel.test.ts

@@ -0,0 +1,251 @@
+import Models from "../../../Models/DatabaseModels/Index";
+import DeletedProject from "../../../Models/DatabaseModels/DeletedProject";
+import Project from "../../../Models/DatabaseModels/Project";
+import User from "../../../Models/DatabaseModels/User";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Migrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import TableColumnType from "../../../Types/Database/TableColumnType";
+import Permission from "../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * DeletedProject is the only record that a deleted project ever existed -
+ * projects are hard deleted, so anything this table does not carry is gone for
+ * good. These tests pin the two properties that cannot be observed from the
+ * service tests: that the snapshot is genuinely standalone (no relation to the
+ * row it describes), and that customer data in it is not reachable by ordinary
+ * project users.
+ */
+
+describe("DeletedProject model", () => {
+  const model: DeletedProject = new DeletedProject();
+
+  it("is registered in the model index, so its table is created", () => {
+    const isRegistered: boolean = Models.some(
+      (registered: { new (): BaseModel }) => {
+        return registered === DeletedProject;
+      },
+    );
+
+    expect(isRegistered).toBe(true);
+  });
+
+  it("is a global table, not scoped to the project it describes", () => {
+    /*
+     * A tenant column here would be a foreign key to Project, and Postgres
+     * would cascade the audit row away with the very project it records.
+     */
+    expect(model.getTenantColumn()).toBeFalsy();
+    expect(model.isTenantModel()).toBe(false);
+  });
+
+  it("is served from its own CRUD endpoint", () => {
+    expect(model.getCrudApiPath()?.toString()).toBe("/deleted-project");
+  });
+
+  it("uses its own table", () => {
+    expect(model.tableName).toBe("DeletedProject");
+  });
+
+  it("records the project identity, so a deleted project can still be identified", () => {
+    const columns: Array<string> = model.getTableColumns().columns;
+
+    for (const column of [
+      "projectId",
+      "projectName",
+      "projectSlug",
+      "projectCreatedAt",
+      "projectDeletedAt",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+
+  it("records who deleted the project and how to reach them", () => {
+    const columns: Array<string> = model.getTableColumns().columns;
+
+    for (const column of [
+      "projectDeletedByUserId",
+      "projectDeletedByUserName",
+      "projectDeletedByUserEmail",
+      "projectCreatedByUserId",
+      "projectCreatedByUserName",
+      "projectCreatedByUserEmail",
+      "companyName",
+      "companyPhoneNumber",
+      "companySize",
+      "jobRole",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+
+  it("records why the customer said they were leaving", () => {
+    expect(model.getTableColumns().columns).toContain("deletionReason");
+  });
+
+  it("stores the reason as unbounded text, so a long answer is not truncated", () => {
+    expect(model.getTableColumnMetadata("deletionReason").type).toBe(
+      TableColumnType.VeryLongText,
+    );
+  });
+
+  it("records what the customer was worth and how much they had built", () => {
+    const columns: Array<string> = model.getTableColumns().columns;
+
+    for (const column of [
+      "planName",
+      "paymentProviderPlanId",
+      "paymentProviderCustomerId",
+      "paymentProviderSubscriptionId",
+      "paymentProviderSubscriptionStatus",
+      "paymentProviderSubscriptionSeats",
+      "trialEndsAt",
+      "activeMonitorCount",
+      "wasProjectBlocked",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+
+  /*
+   * The project row is deleted before this one is written. A relation would
+   * have nothing to point at - which is why projectId is a plain uuid and the
+   * name, slug and dates are copied rather than joined.
+   */
+  it("keeps the project id as a plain column, not a relation to Project", () => {
+    expect(model.getTableColumnMetadata("projectId").type).toBe(
+      TableColumnType.ObjectID,
+    );
+    expect(model.getTableColumnMetadata("projectId").modelType).toBeUndefined();
+    expect(model.getTableColumns().columns).not.toContain("project");
+  });
+
+  it("requires the project id, name and deletion time on every row", () => {
+    expect(model.getTableColumnMetadata("projectId").required).toBe(true);
+    expect(model.getTableColumnMetadata("projectName").required).toBe(true);
+    expect(model.getTableColumnMetadata("projectDeletedAt").required).toBe(
+      true,
+    );
+  });
+
+  /*
+   * The user relations exist only so staff can jump to the account. They must
+   * be nullable and non-cascading: a user who later deletes their account must
+   * not take the record of the project deletion with them, which is also why
+   * the name and email are copied onto the row.
+   */
+  it("relates to the users involved without depending on them surviving", () => {
+    expect(model.getTableColumnMetadata("projectDeletedByUser").modelType).toBe(
+      User,
+    );
+    expect(model.getTableColumnMetadata("projectCreatedByUser").modelType).toBe(
+      User,
+    );
+    expect(model.getTableColumnMetadata("projectDeletedByUser").required).toBe(
+      undefined,
+    );
+  });
+
+  /*
+   * Every column carries names, emails and phone numbers of customers who have
+   * already left. Empty permission arrays are how this repo says "master admin
+   * only" - no user permission can intersect an empty list, and root and
+   * master admin bypass the check entirely.
+   */
+  it("cannot be read, written or deleted by any project user", () => {
+    expect(model.getCreatePermissions()).toEqual([]);
+    expect(model.getReadPermissions()).toEqual([]);
+    expect(model.getUpdatePermissions()).toEqual([]);
+    expect(model.getDeletePermissions()).toEqual([]);
+  });
+
+  it("locks down every single column, not just the table", () => {
+    const accessControl: Record<string, ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    /*
+     * _id and the timestamps come from the base model and carry no column
+     * access control of their own. Every column this model declares must have
+     * one - a column added without the decorator is the case worth catching,
+     * so its absence fails rather than being skipped.
+     */
+    const baseModelColumns: Array<string> = [
+      "_id",
+      "createdAt",
+      "updatedAt",
+      "deletedAt",
+      "version",
+    ];
+
+    const declaredColumns: Array<string> = model
+      .getTableColumns()
+      .columns.filter((columnName: string) => {
+        return !baseModelColumns.includes(columnName);
+      });
+
+    expect(declaredColumns.length).toBeGreaterThan(20);
+
+    for (const columnName of declaredColumns) {
+      const columnAccess: ColumnAccessControl | undefined =
+        accessControl[columnName];
+
+      expect(columnAccess).toBeDefined();
+      expect(columnAccess?.create).toEqual([]);
+      expect(columnAccess?.read).toEqual([]);
+      expect(columnAccess?.update).toEqual([]);
+    }
+  });
+
+  it("does not hand a project owner any permission over it", () => {
+    expect(model.getReadPermissions()).not.toContain(Permission.ProjectOwner);
+    expect(model.getReadPermissions()).not.toContain(Permission.ProjectAdmin);
+  });
+});
+
+describe("Project model - deletion snapshot source columns", () => {
+  const project: Project = new Project();
+
+  /*
+   * ProjectService.onBeforeDelete reads these off the project before it is
+   * deleted and DeletedProjectService copies them onto the audit row. If one
+   * is renamed the snapshot silently loses a field, so pin them here.
+   */
+  it("still has every column the deletion snapshot copies", () => {
+    const columns: Array<string> = project.getTableColumns().columns;
+
+    for (const column of [
+      "name",
+      "slug",
+      "planName",
+      "paymentProviderPlanId",
+      "paymentProviderCustomerId",
+      "paymentProviderSubscriptionId",
+      "paymentProviderSubscriptionStatus",
+      "paymentProviderSubscriptionSeats",
+      "trialEndsAt",
+      "currentActiveMonitorsCount",
+      "isBlocked",
+      "createdByUserId",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+});
+
+describe("DeletedProject migration", () => {
+  /*
+   * A migration that is not in this array never runs, so the table simply does
+   * not exist in a fresh database and every project delete logs an error.
+   */
+  it("is registered, so the table is actually created", () => {
+    const registeredNames: Array<string> = (
+      Migrations as unknown as Array<{ name: string }>
+    ).map((migration: { name: string }) => {
+      return migration.name;
+    });
+
+    expect(registeredNames).toContain("AddDeletedProjectTable1786461136170");
+  });
+});

package/Tests/Models/DatabaseModels/SavedViewJSONColumnTuples.test.ts

@@ -0,0 +1,115 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import MetricSavedView from "../../../Models/DatabaseModels/MetricSavedView";
+import TraceSavedView from "../../../Models/DatabaseModels/TraceSavedView";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import TelemetrySavedViewState from "../../../Types/Telemetry/TelemetrySavedViewState";
+import { readSavedViewFilters } from "../../../Utils/Telemetry/SavedViewFilters";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * A saved view's filter tuples pass through DatabaseBaseModel.toJSON twice:
+ * once in the browser on the way to the API, and once on the server on the way
+ * back out — every REST response for a model goes through it. Both directions
+ * ran the serializer that flattened nested arrays, so a row could be perfectly
+ * intact in Postgres and still reach the browser as
+ * { "0": facetKey, "1": value }.
+ *
+ * That is why this is pinned at the model layer and not only on the helper:
+ * the read path has to hold on its own, or a patched browser talking to an
+ * unpatched API is still broken.
+ */
+
+const SAVED_STATE: TelemetrySavedViewState = {
+  search: "status:error",
+  filters: [
+    ["primaryEntityId", "6512f1a0a1b2c3d4e5f60718"],
+    ["attributes.http.method", "GET"],
+  ],
+  timeRange: { range: "Past one hour" },
+  pageSize: 50,
+  rootOnly: false,
+};
+
+function readFiltersFromJSON(json: JSONObject): JSONArray {
+  return (json["query"] as JSONObject)["filters"] as JSONArray;
+}
+
+describe("Saved view JSON columns keep their filter tuples through toJSON", () => {
+  test("TraceSavedView keeps filters as arrays", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.name = "Errors in checkout";
+    view.query = SAVED_STATE;
+
+    const json: JSONObject = BaseModel.toJSON(view, TraceSavedView);
+    const filters: JSONArray = readFiltersFromJSON(json);
+
+    expect(Array.isArray(filters)).toBe(true);
+    expect(Array.isArray(filters[0])).toBe(true);
+    expect(filters).toEqual(SAVED_STATE.filters);
+  });
+
+  test("MetricSavedView keeps filters as arrays", () => {
+    const view: MetricSavedView = new MetricSavedView();
+    view.name = "Hot services";
+    view.query = SAVED_STATE;
+
+    const json: JSONObject = BaseModel.toJSON(view, MetricSavedView);
+    const filters: JSONArray = readFiltersFromJSON(json);
+
+    expect(Array.isArray(filters)).toBe(true);
+    expect(Array.isArray(filters[0])).toBe(true);
+    expect(filters).toEqual(SAVED_STATE.filters);
+  });
+
+  test("A serialized view is still readable by the explorer", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.query = SAVED_STATE;
+
+    const json: JSONObject = BaseModel.toJSON(view, TraceSavedView);
+
+    expect(readSavedViewFilters(readFiltersFromJSON(json))).toEqual(
+      SAVED_STATE.filters,
+    );
+  });
+
+  test("The rest of the saved state is untouched", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.query = SAVED_STATE;
+
+    const query: JSONObject = BaseModel.toJSON(view, TraceSavedView)[
+      "query"
+    ] as JSONObject;
+
+    expect(query["search"]).toBe("status:error");
+    expect(query["pageSize"]).toBe(50);
+    expect(query["rootOnly"]).toBe(false);
+    expect(query["timeRange"]).toEqual({ range: "Past one hour" });
+  });
+
+  test("A view survives two passes, the way it does browser-to-API-to-browser", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.query = SAVED_STATE;
+
+    // Write side (browser -> API), then read side (API -> browser).
+    const written: JSONObject = BaseModel.toJSON(view, TraceSavedView);
+    const reloaded: TraceSavedView = BaseModel.fromJSON(
+      written,
+      TraceSavedView,
+    ) as TraceSavedView;
+    const returned: JSONObject = BaseModel.toJSON(reloaded, TraceSavedView);
+
+    expect(readFiltersFromJSON(returned)).toEqual(SAVED_STATE.filters);
+  });
+
+  test("A view with no filters serializes without inventing any", () => {
+    const view: TraceSavedView = new TraceSavedView();
+    view.query = { search: "status:error" };
+
+    const query: JSONObject = BaseModel.toJSON(view, TraceSavedView)[
+      "query"
+    ] as JSONObject;
+
+    expect(query["filters"]).toBeUndefined();
+    expect(readSavedViewFilters(query["filters"])).toEqual([]);
+  });
+});