@oneuptime/common 12.0.6 → 12.0.8

package/Tests/Server/Utils/AI/LLMServiceEgressGuard.test.ts

@@ -0,0 +1,315 @@
+import API, { RequestOptions } from "../../../../Utils/API";
+import HTTPResponse from "../../../../Types/API/HTTPResponse";
+import { JSONObject } from "../../../../Types/JSON";
+import LlmType from "../../../../Types/LLM/LlmType";
+import LLMService from "../../../../Server/Utils/LLM/LLMService";
+import DataSourceEgressGuard, {
+  EgressResolveFunction,
+  ResolvedAddress,
+} from "../../../../Server/Utils/DataSource/EgressGuard";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import dns from "dns";
+
+/*
+ * LlmProvider.baseUrl is writable by any ProjectMember, while reading the
+ * provider's apiKey is restricted to Owner/Admin. So an unguarded outbound
+ * request is a privilege escalation with two payouts: the decrypted key goes
+ * out in the auth header of a request to a host the member chose, and the
+ * provider's error body is reflected back through the LLM provider API, which
+ * turns the same lever into a read primitive against the internal network.
+ *
+ * These tests assert that no request leaves for an internal address, that the
+ * checked address is pinned into the socket, and that redirects are refused.
+ * DNS is mocked so they are deterministic and offline.
+ */
+
+type LookupSpy = jest.SpiedFunction<
+  (
+    hostname: string,
+    options: { all: true },
+  ) => Promise<Array<{ address: string; family: number }>>
+>;
+
+let lookupSpy: LookupSpy;
+
+// Every API.post the service made, so tests can assert on "never sent".
+const postCalls: Array<{ options?: RequestOptions | undefined }> = [];
+
+function mockPostSuccess(): void {
+  jest.spyOn(API, "post").mockImplementation(((options: {
+    options?: RequestOptions | undefined;
+  }) => {
+    postCalls.push(options);
+
+    return Promise.resolve({
+      jsonData: {
+        choices: [{ message: { content: "ok" } }],
+        content: [{ type: "text", text: "ok" }],
+        message: { content: "ok" },
+        usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 },
+      },
+    } as unknown as HTTPResponse<JSONObject>);
+  }) as never);
+}
+
+function lastPostOptions(): RequestOptions {
+  return postCalls[postCalls.length - 1]!.options as RequestOptions;
+}
+
+beforeEach(() => {
+  postCalls.length = 0;
+  lookupSpy = jest.spyOn(dns.promises, "lookup") as unknown as LookupSpy;
+
+  /*
+   * Stand in for getaddrinfo: "localhost" is loopback, everything else is a
+   * public address. Individual tests override this to model rebinding.
+   */
+  lookupSpy.mockImplementation((hostname: string) => {
+    if (hostname === "localhost") {
+      return Promise.resolve([{ address: "127.0.0.1", family: 4 }]);
+    }
+
+    return Promise.resolve([{ address: "93.184.216.34", family: 4 }]);
+  });
+
+  mockPostSuccess();
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("LLMService refuses internal LLM provider base URLs", () => {
+  const blockedBaseUrls: Array<string> = [
+    "http://127.0.0.1:11434",
+    "http://localhost:11434",
+    "http://169.254.169.254",
+    "http://169.254.169.254:80",
+    "http://[::1]:11434",
+    "http://0.0.0.0:11434",
+  ];
+
+  test.each(blockedBaseUrls)(
+    "OpenAI-compatible provider at %s never posts",
+    async (baseUrl: string) => {
+      await expect(
+        LLMService.getCompletion({
+          llmProviderConfig: {
+            llmType: LlmType.OpenAICompatible,
+            apiKey: "sk-secret",
+            modelName: "some-model",
+            baseUrl,
+          },
+          messages: [{ role: "user", content: "hi" }],
+        }),
+      ).rejects.toThrow();
+
+      expect(postCalls).toHaveLength(0);
+    },
+  );
+
+  test("Ollama provider at a loopback base URL never posts", async () => {
+    await expect(
+      LLMService.getCompletion({
+        llmProviderConfig: {
+          llmType: LlmType.Ollama,
+          modelName: "llama2",
+          baseUrl: "http://127.0.0.1:11434",
+        },
+        messages: [{ role: "user", content: "hi" }],
+      }),
+    ).rejects.toThrow();
+
+    expect(postCalls).toHaveLength(0);
+  });
+
+  test("Anthropic provider repointed at the metadata endpoint never posts", async () => {
+    await expect(
+      LLMService.getCompletion({
+        llmProviderConfig: {
+          llmType: LlmType.Anthropic,
+          apiKey: "sk-ant-secret",
+          modelName: "claude-sonnet-4-20250514",
+          baseUrl: "http://169.254.169.254/latest",
+        },
+        messages: [{ role: "user", content: "hi" }],
+      }),
+    ).rejects.toThrow();
+
+    expect(postCalls).toHaveLength(0);
+  });
+
+  test("Azure provider repointed at loopback never posts", async () => {
+    await expect(
+      LLMService.getCompletion({
+        llmProviderConfig: {
+          llmType: LlmType.AzureOpenAI,
+          apiKey: "azure-secret",
+          modelName: "gpt-4o",
+          baseUrl: "http://127.0.0.1/openai/deployments/gpt-4o",
+        },
+        messages: [{ role: "user", content: "hi" }],
+      }),
+    ).rejects.toThrow();
+
+    expect(postCalls).toHaveLength(0);
+  });
+
+  test("a public hostname that resolves to a private address never posts", async () => {
+    // The DNS-rebinding shape: the name looks fine, the answer does not.
+    lookupSpy.mockResolvedValue([{ address: "10.0.0.5", family: 4 }]);
+
+    /*
+     * Private ranges are only blocked under SaaS policy; this is the
+     * documented switch that turns it on for a self-hosted install.
+     */
+    process.env["DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES"] = "true";
+
+    try {
+      await expect(
+        LLMService.getCompletion({
+          llmProviderConfig: {
+            llmType: LlmType.OpenAICompatible,
+            apiKey: "sk-secret",
+            modelName: "some-model",
+            baseUrl: "https://ollama.attacker.example/v1",
+          },
+          messages: [{ role: "user", content: "hi" }],
+        }),
+      ).rejects.toThrow();
+    } finally {
+      delete process.env["DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES"];
+    }
+
+    expect(postCalls).toHaveLength(0);
+  });
+});
+
+describe("LLMService pins and refuses redirects on allowed providers", () => {
+  test("a public provider posts with redirects disabled and pinned agents", async () => {
+    await LLMService.getCompletion({
+      llmProviderConfig: {
+        llmType: LlmType.OpenAICompatible,
+        apiKey: "sk-secret",
+        modelName: "some-model",
+        baseUrl: "https://gateway.example.com/v1",
+      },
+      messages: [{ role: "user", content: "hi" }],
+    });
+
+    const options: RequestOptions = lastPostOptions();
+
+    expect(options.doNotFollowRedirects).toBe(true);
+    expect(options.httpAgent).toBeDefined();
+    expect(options.httpsAgent).toBeDefined();
+  });
+
+  test("the pinned agent dials the address that was validated", async () => {
+    lookupSpy.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+
+    await LLMService.getCompletion({
+      llmProviderConfig: {
+        llmType: LlmType.Anthropic,
+        apiKey: "sk-ant-secret",
+        modelName: "claude-sonnet-4-20250514",
+        baseUrl: "https://api.anthropic.com/v1",
+      },
+      messages: [{ role: "user", content: "hi" }],
+    });
+
+    const options: RequestOptions = lastPostOptions();
+
+    const lookup: (
+      hostname: string,
+      lookupOptions: { all?: boolean },
+      callback: (error: Error | null, address: string, family?: number) => void,
+    ) => void = (
+      options.httpsAgent as unknown as {
+        options: {
+          lookup: (
+            hostname: string,
+            lookupOptions: { all?: boolean },
+            callback: (
+              error: Error | null,
+              address: string,
+              family?: number,
+            ) => void,
+          ) => void;
+        };
+      }
+    ).options.lookup;
+
+    const dialed: string = await new Promise((resolve: (v: string) => void) => {
+      lookup(
+        "api.anthropic.com",
+        { all: false },
+        (_error: Error | null, address: string) => {
+          resolve(address);
+        },
+      );
+    });
+
+    expect(dialed).toBe("93.184.216.34");
+  });
+
+  test("the guard resolves once per completion, not once per retry", async () => {
+    /*
+     * postOpenAIChatCompletion re-posts when the provider rejects a generation
+     * parameter. Re-resolving per attempt would add a fresh rebind window
+     * between attempts.
+     */
+    await LLMService.getCompletion({
+      llmProviderConfig: {
+        llmType: LlmType.OpenAICompatible,
+        apiKey: "sk-secret",
+        modelName: "some-model",
+        baseUrl: "https://gateway.example.com/v1",
+      },
+      messages: [{ role: "user", content: "hi" }],
+    });
+
+    expect(lookupSpy).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("DataSourceEgressGuard self-hosted policy for LLM providers", () => {
+  const resolveToPrivate: EgressResolveFunction = (): Promise<
+    Array<ResolvedAddress>
+  > => {
+    return Promise.resolve([{ address: "10.0.0.5", family: 4 }]);
+  };
+
+  test("a self-hosted Ollama on a private address is still reachable", async () => {
+    // The documented deployment: blockPrivateAddresses off (no billing).
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowed("http://ollama.internal:11434", {
+        blockPrivateAddresses: false,
+        resolveFunction: resolveToPrivate,
+        targetLabel: "LLM provider",
+      }),
+    ).resolves.toBeDefined();
+  });
+
+  test("but loopback and link-local are blocked even self-hosted", async () => {
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowed("http://127.0.0.1:11434", {
+        blockPrivateAddresses: false,
+        targetLabel: "LLM provider",
+      }),
+    ).rejects.toThrow();
+
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowed("http://169.254.169.254/", {
+        blockPrivateAddresses: false,
+        targetLabel: "LLM provider",
+      }),
+    ).rejects.toThrow();
+  });
+});

package/Tests/Server/Utils/AI/LLMServiceModelCompatibility.test.ts

@@ -1,4 +1,5 @@
 import API from "../../../../Utils/API";
+import stubLLMEgressGuard from "./StubLLMEgressGuard";
 import logger from "../../../../Server/Utils/Logger";
 import HTTPErrorResponse from "../../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../../Types/API/HTTPResponse";
@@ -90,6 +91,8 @@ function bodyOf(spy: PostSpy, callIndex: number): JSONObject {
 }
 
 beforeEach(() => {
+  // These hosts are placeholders; the SSRF guard is covered elsewhere.
+  stubLLMEgressGuard();
   LLMService.clearRequestAdaptationCache();
   jest.spyOn(logger, "debug").mockImplementation((): void => {});
   jest.spyOn(logger, "error").mockImplementation((): void => {});

package/Tests/Server/Utils/AI/LLMServiceRequestPolicy.test.ts

@@ -7,7 +7,8 @@ import LlmType from "../../../../Types/LLM/LlmType";
 import LLMService, {
   LLMProviderConfig,
 } from "../../../../Server/Utils/LLM/LLMService";
-import { afterEach, describe, expect, test } from "@jest/globals";
+import stubLLMEgressGuard from "./StubLLMEgressGuard";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
 
 type PostSpy = ReturnType<typeof jest.spyOn>;
 
@@ -83,6 +84,11 @@ function mockPost(response: JSONObject): PostSpy {
   } as unknown as HTTPResponse<JSONObject>) as PostSpy;
 }
 
+// These hosts are placeholders; the SSRF guard is covered elsewhere.
+beforeEach(() => {
+  stubLLMEgressGuard();
+});
+
 afterEach(() => {
   jest.restoreAllMocks();
 });
@@ -103,11 +109,16 @@ describe("LLMService request timeout and retry policy", () => {
       expect(postSpy).toHaveBeenCalledTimes(1);
       expect(postSpy.mock.calls[0]![0]).toEqual(
         expect.objectContaining({
-          options: {
+          options: expect.objectContaining({
             retries: 0,
             exponentialBackoff: true,
             timeout: 12_345,
-          },
+            /*
+             * Every provider request also carries the SSRF guard's
+             * settings — the policy above must not displace them.
+             */
+            doNotFollowRedirects: true,
+          }),
         }),
       );
     },
@@ -125,11 +136,12 @@ describe("LLMService request timeout and retry policy", () => {
 
       expect(postSpy.mock.calls[0]![0]).toEqual(
         expect.objectContaining({
-          options: {
+          options: expect.objectContaining({
             retries: 2,
             exponentialBackoff: true,
             timeout: defaultTimeoutInMs,
-          },
+            doNotFollowRedirects: true,
+          }),
         }),
       );
     },

package/Tests/Server/Utils/AI/LLMServiceToolCalling.test.ts

@@ -5,7 +5,15 @@ import LlmType from "../../../../Types/LLM/LlmType";
 import LLMService, {
   LLMCompletionResponse,
 } from "../../../../Server/Utils/LLM/LLMService";
-import { afterEach, describe, expect, jest, test } from "@jest/globals";
+import stubLLMEgressGuard from "./StubLLMEgressGuard";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
 
 type PostSpy = ReturnType<typeof jest.spyOn>;
 
@@ -15,6 +23,11 @@ function mockPostResponse(jsonData: JSONObject): PostSpy {
   } as unknown as HTTPResponse<JSONObject>) as PostSpy;
 }
 
+// These hosts are placeholders; the SSRF guard is covered elsewhere.
+beforeEach(() => {
+  stubLLMEgressGuard();
+});
+
 afterEach(() => {
   jest.restoreAllMocks();
 });

package/Tests/Server/Utils/AI/ObservabilityChatPrompt.test.ts

@@ -140,3 +140,38 @@ describe("buildObservabilityChatSystemPrompt with page context", () => {
     expect(prompt).toContain("Cite your sources.");
   });
 });
+
+/*
+ * open_code_pull_request now opens the PR ready for review rather than as a
+ * draft. The system prompt describes that tool to the model in its own words,
+ * so a stale sentence here makes the model tell the user it filed a draft and
+ * that they should go mark it ready — for a PR that already is.
+ *
+ * What must stay is the part that was never about the draft flag: this is a
+ * proposal off the default branch that a human reviews and merges.
+ */
+describe("buildObservabilityChatSystemPrompt — how it describes code changes", () => {
+  const prompt: string = buildObservabilityChatSystemPrompt({
+    currentTime: new Date("2026-07-16T00:00:00Z"),
+    permissionMode: AIChatPermissionMode.AskForApproval,
+  });
+
+  test("does not tell the model the pull request is a draft", () => {
+    expect(prompt.toLowerCase()).not.toContain("draft pull request");
+  });
+
+  test("says the pull request opens ready for review", () => {
+    expect(prompt).toContain("ready for review");
+  });
+
+  test("still says the change goes off the default branch for a human", () => {
+    expect(prompt).toContain("off the default branch");
+    expect(prompt).toContain("for a human to review");
+  });
+
+  test("still prefers open_code_pull_request over committing to a branch", () => {
+    expect(prompt).toContain(
+      "open_code_pull_request is the right tool almost always",
+    );
+  });
+});

package/Tests/Server/Utils/AI/StubLLMEgressGuard.ts

@@ -0,0 +1,25 @@
+import DataSourceEgressGuard from "../../../../Server/Utils/DataSource/EgressGuard";
+import { jest } from "@jest/globals";
+
+/*
+ * LLMService validates and pins every provider URL through the SSRF egress
+ * guard before posting, which means a real DNS lookup for whatever host the
+ * test configured. The suites that are about request SHAPE rather than egress
+ * policy use unresolvable placeholder hosts ("http://host:8000"), so they stub
+ * the guard and stay offline.
+ *
+ * Call this from a beforeEach, before the API.post stub. Egress policy itself
+ * is covered by LLMServiceEgressGuard.test.ts, which does NOT stub it.
+ */
+export default function stubLLMEgressGuard(): void {
+  jest
+    .spyOn(DataSourceEgressGuard, "assertUrlAllowedAndPin")
+    .mockImplementation((urlString: string) => {
+      return Promise.resolve({
+        url: new globalThis.URL(urlString),
+        addresses: [{ address: "93.184.216.34", family: 4 }],
+        httpAgent: undefined as never,
+        httpsAgent: undefined as never,
+      });
+    });
+}

package/Tests/Server/Utils/AnalyticsDatabase/QuerySettingsHelper.test.ts

@@ -0,0 +1,152 @@
+import QuerySettingsHelper, {
+  getQuerySettings,
+  DEFAULT_MAX_MEMORY_USAGE_IN_BYTES,
+  DEFAULT_MAX_BYTES_BEFORE_EXTERNAL_GROUP_BY_IN_BYTES,
+  DEFAULT_MAX_BYTES_BEFORE_EXTERNAL_SORT_IN_BYTES,
+} from "../../../../Server/Utils/AnalyticsDatabase/QuerySettingsHelper";
+
+/*
+ * Unit tests for getQuerySettings — the builder for the trailing
+ * ` SETTINGS ...` clause appended verbatim to every ClickHouse read query.
+ *
+ * The clause is NOT parameterized; it is concatenated straight into SQL, so
+ * the exact emitted text matters. These tests lock down:
+ *   - the always-present per-query memory ceiling and spill thresholds,
+ *   - correct quoting (strings single-quoted, numbers bare),
+ *   - the conditional execution-time / overflow-mode settings, and
+ *   - the ordering of the emitted parts.
+ */
+
+describe("getQuerySettings", () => {
+  test("always emits the memory ceiling and spill thresholds by default", () => {
+    const clause: string = getQuerySettings();
+
+    expect(clause).toBe(
+      ` SETTINGS max_memory_usage = ${DEFAULT_MAX_MEMORY_USAGE_IN_BYTES}, ` +
+        `max_bytes_before_external_group_by = ${DEFAULT_MAX_BYTES_BEFORE_EXTERNAL_GROUP_BY_IN_BYTES}, ` +
+        `max_bytes_before_external_sort = ${DEFAULT_MAX_BYTES_BEFORE_EXTERNAL_SORT_IN_BYTES}`,
+    );
+  });
+
+  test("produces the same output whether called with no args or undefined", () => {
+    expect(getQuerySettings()).toBe(getQuerySettings(undefined));
+  });
+
+  test("always starts with the ` SETTINGS ` keyword and a leading space", () => {
+    expect(getQuerySettings().startsWith(" SETTINGS ")).toBe(true);
+    expect(
+      getQuerySettings({ maxExecutionTimeInSeconds: 30 }).startsWith(
+        " SETTINGS ",
+      ),
+    ).toBe(true);
+  });
+
+  test("omits execution-time settings when not provided", () => {
+    const clause: string = getQuerySettings();
+
+    expect(clause).not.toContain("max_execution_time");
+    expect(clause).not.toContain("timeout_overflow_mode");
+  });
+
+  test("includes max_execution_time when provided", () => {
+    const clause: string = getQuerySettings({ maxExecutionTimeInSeconds: 45 });
+
+    expect(clause).toContain("max_execution_time = 45");
+    // Execution time is emitted before the memory settings.
+    expect(clause.indexOf("max_execution_time")).toBeLessThan(
+      clause.indexOf("max_memory_usage"),
+    );
+  });
+
+  test("single-quotes the timeout overflow mode", () => {
+    expect(getQuerySettings({ timeoutOverflowMode: "break" })).toContain(
+      "timeout_overflow_mode = 'break'",
+    );
+    expect(getQuerySettings({ timeoutOverflowMode: "throw" })).toContain(
+      "timeout_overflow_mode = 'throw'",
+    );
+  });
+
+  test("emits execution time before overflow mode before memory settings", () => {
+    const clause: string = getQuerySettings({
+      maxExecutionTimeInSeconds: 10,
+      timeoutOverflowMode: "break",
+    });
+
+    const timePos: number = clause.indexOf("max_execution_time");
+    const overflowPos: number = clause.indexOf("timeout_overflow_mode");
+    const memoryPos: number = clause.indexOf("max_memory_usage");
+
+    expect(timePos).toBeGreaterThan(-1);
+    expect(timePos).toBeLessThan(overflowPos);
+    expect(overflowPos).toBeLessThan(memoryPos);
+  });
+
+  test("honours overrides for the memory ceiling and spill thresholds", () => {
+    const clause: string = getQuerySettings({
+      maxMemoryUsageInBytes: 100,
+      maxBytesBeforeExternalGroupByInBytes: 50,
+      maxBytesBeforeExternalSortInBytes: 25,
+    });
+
+    expect(clause).toContain("max_memory_usage = 100");
+    expect(clause).toContain("max_bytes_before_external_group_by = 50");
+    expect(clause).toContain("max_bytes_before_external_sort = 25");
+    // The defaults must not leak through when overridden.
+    expect(clause).not.toContain(`${DEFAULT_MAX_MEMORY_USAGE_IN_BYTES}`);
+  });
+
+  test("emits numeric additional settings without quotes", () => {
+    const clause: string = getQuerySettings({
+      additionalSettings: { max_threads: 4 },
+    });
+
+    expect(clause).toContain("max_threads = 4");
+    expect(clause).not.toContain("max_threads = '4'");
+  });
+
+  test("single-quotes string additional settings", () => {
+    const clause: string = getQuerySettings({
+      additionalSettings: { optimize_aggregation_in_order: "1" },
+    });
+
+    expect(clause).toContain("optimize_aggregation_in_order = '1'");
+  });
+
+  test("appends additional settings after the memory settings", () => {
+    const clause: string = getQuerySettings({
+      additionalSettings: { optimize_use_projections: 1 },
+    });
+
+    expect(clause.indexOf("max_bytes_before_external_sort")).toBeLessThan(
+      clause.indexOf("optimize_use_projections"),
+    );
+  });
+
+  test("joins every setting with a comma-and-space separator", () => {
+    const clause: string = getQuerySettings({
+      maxExecutionTimeInSeconds: 5,
+      timeoutOverflowMode: "throw",
+      additionalSettings: { max_threads: 2 },
+    });
+
+    /*
+     * The clause after " SETTINGS " is a comma-separated list; splitting it
+     * must yield one entry per emitted setting (2 conditional + 3 memory + 1
+     * extra).
+     */
+    const body: string = clause.replace(" SETTINGS ", "");
+    expect(body.split(", ").length).toBe(6);
+  });
+
+  test("class static method delegates to the standalone function", () => {
+    const options: { maxExecutionTimeInSeconds: number } = {
+      maxExecutionTimeInSeconds: 12,
+    };
+
+    expect(QuerySettingsHelper.getQuerySettings(options)).toBe(
+      getQuerySettings(options),
+    );
+    expect(QuerySettingsHelper.getQuerySettings()).toBe(getQuerySettings());
+  });
+});