@oneuptime/common 12.0.7 → 12.0.9

package/Tests/Server/Types/Workflow/Components/ApiComponentErrorPort.test.ts

@@ -269,9 +269,10 @@ describe.each(apiComponents)(
       );
 
       expect(result.executePort?.id).toBe("error");
-      expect(result.returnValues["errorMessage"]).toBe(
+      expect(result.returnValues["error"]).toBe(
         "connect ECONNREFUSED 127.0.0.1:443",
       );
+      expect(result.returnValues["errorMessage"]).toBeUndefined();
       expect(fixture.onError).not.toHaveBeenCalled();
     });
 

package/Tests/Server/Types/Workflow/Components/ApiComponentHeaders.test.ts

@@ -0,0 +1,192 @@
+/*
+ * Request headers on the API components reach sanitizeArgs in three shapes: a
+ * JSON string (every workflow written before the key/value editor), an object
+ * (what the key/value editor produces), and whatever a {{...}} substitution
+ * left behind. Every consumer downstream casts the result to
+ * Dictionary<string> and spreads it into the outgoing request, so the shape
+ * has to be settled here.
+ */
+
+jest.mock("../../../../../Utils/API", () => {
+  return {
+    __esModule: true,
+    default: {
+      get: jest.fn(),
+      post: jest.fn(),
+      put: jest.fn(),
+      patch: jest.fn(),
+      delete: jest.fn(),
+    },
+  };
+});
+
+import ApiGet from "../../../../../Server/Types/Workflow/Components/API/Get";
+import { ApiComponentUtils } from "../../../../../Server/Types/Workflow/Components/API/Utils";
+import ComponentCode, {
+  RunOptions,
+} from "../../../../../Server/Types/Workflow/ComponentCode";
+import Exception from "../../../../../Types/Exception/Exception";
+import { JSONObject } from "../../../../../Types/JSON";
+import ObjectID from "../../../../../Types/ObjectID";
+import IconProp from "../../../../../Types/Icon/IconProp";
+import ComponentMetadata, {
+  Argument,
+  ComponentInputType,
+  ComponentType,
+} from "../../../../../Types/Workflow/Component";
+import APIComponents from "../../../../../Types/Workflow/Components/API";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+import dns from "dns";
+
+type MakeOptionsFunction = () => RunOptions;
+
+const makeOptions: MakeOptionsFunction = (): RunOptions => {
+  return {
+    log: jest.fn() as RunOptions["log"],
+    workflowLogId: ObjectID.generate(),
+    workflowId: ObjectID.generate(),
+    projectId: ObjectID.generate(),
+    onError: ((exception: Exception): Exception => {
+      return exception;
+    }) as RunOptions["onError"],
+    executeWorkflow: async (): Promise<void> => {},
+  };
+};
+
+type SanitizeFunction = (headers: unknown) => Promise<JSONObject>;
+
+const sanitizeHeaders: SanitizeFunction = async (
+  headers: unknown,
+): Promise<JSONObject> => {
+  const component: ComponentCode = new ApiGet();
+
+  const result: { args: JSONObject } = await ApiComponentUtils.sanitizeArgs(
+    component.getMetadata(),
+    {
+      url: "https://api.example.com/thing",
+      "request-headers": headers as JSONObject,
+    },
+    makeOptions(),
+  );
+
+  return result.args["request-headers"] as JSONObject;
+};
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  jest
+    .spyOn(dns.promises, "lookup")
+    .mockResolvedValue([{ address: "93.184.216.34", family: 4 }] as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("ApiComponentUtils.sanitizeArgs — header shapes", () => {
+  test("parses the legacy JSON-string shape", async () => {
+    await expect(
+      sanitizeHeaders('{"Authorization": "Bearer abc"}'),
+    ).resolves.toEqual({
+      Authorization: "Bearer abc",
+    });
+  });
+
+  test("parses a JSON5 string, which has always been accepted here", async () => {
+    await expect(
+      sanitizeHeaders("{Authorization: 'Bearer abc'}"),
+    ).resolves.toEqual({
+      Authorization: "Bearer abc",
+    });
+  });
+
+  test("passes the object shape through", async () => {
+    await expect(
+      sanitizeHeaders({ Authorization: "Bearer abc" }),
+    ).resolves.toEqual({ Authorization: "Bearer abc" });
+  });
+
+  test("flattens numbers and booleans the key/value editor can emit", async () => {
+    await expect(
+      sanitizeHeaders({ "X-Retries": 3, "X-Debug": true }),
+    ).resolves.toEqual({
+      "X-Retries": "3",
+      "X-Debug": "true",
+    });
+  });
+
+  test("drops null and undefined values instead of sending 'null'", async () => {
+    await expect(
+      sanitizeHeaders({ "X-A": "keep", "X-B": null }),
+    ).resolves.toEqual({ "X-A": "keep" });
+  });
+
+  test("serializes a nested value rather than sending [object Object]", async () => {
+    await expect(sanitizeHeaders({ "X-Meta": { a: 1 } })).resolves.toEqual({
+      "X-Meta": '{"a":1}',
+    });
+  });
+
+  test("rejects an array, which would spread into per-index junk headers", async () => {
+    await expect(sanitizeHeaders("[1, 2]")).rejects.toThrow(
+      /Request headers must be a JSON object/,
+    );
+  });
+
+  test("rejects a bare scalar", async () => {
+    await expect(sanitizeHeaders("42")).rejects.toThrow(
+      /Request headers must be a JSON object/,
+    );
+  });
+
+  test("leaves the request alone when no headers were given", async () => {
+    const component: ComponentCode = new ApiGet();
+
+    const result: { args: JSONObject } = await ApiComponentUtils.sanitizeArgs(
+      component.getMetadata(),
+      { url: "https://api.example.com/thing" },
+      makeOptions(),
+    );
+
+    expect(result.args["request-headers"]).toBeUndefined();
+  });
+});
+
+describe("API component metadata — headers are treated as secret", () => {
+  /*
+   * The key/value grid makes pasting a bearer token into a header the obvious
+   * thing to do. Without isSensitive the resolved value is written verbatim
+   * into the WorkflowLog for anyone who can read the project.
+   */
+  test("every API component marks request-headers sensitive", () => {
+    const componentsWithHeaders: Array<ComponentMetadata> =
+      APIComponents.filter((component: ComponentMetadata) => {
+        return component.arguments.some((arg: Argument) => {
+          return arg.id === "request-headers";
+        });
+      });
+
+    expect(componentsWithHeaders.length).toBe(5);
+
+    for (const component of componentsWithHeaders) {
+      const headerArgument: Argument = component.arguments.find(
+        (arg: Argument) => {
+          return arg.id === "request-headers";
+        },
+      ) as Argument;
+
+      expect(headerArgument.isSensitive).toBe(true);
+      expect(headerArgument.type).toBe(ComponentInputType.StringDictionary);
+    }
+  });
+
+  test("the components are the five request verbs", () => {
+    expect(
+      APIComponents.filter((component: ComponentMetadata) => {
+        return component.componentType === ComponentType.Component;
+      }).length,
+    ).toBeGreaterThanOrEqual(5);
+
+    expect(APIComponents[0]?.iconProp).toBe(IconProp.Globe);
+  });
+});

package/Tests/Server/Types/Workflow/Components/BaseModelDatabaseComponents.test.ts

@@ -740,3 +740,193 @@ describe("Create Many", () => {
     expect(service.create).toHaveBeenCalledTimes(1);
   });
 });
+
+/*
+ * Create used to discard a key it did not recognise without a word.
+ * DatabaseBaseModel._fromJSON assigns only when getTableColumnMetadata returns
+ * something and has no else branch, so a misspelled column never reached the
+ * record. A required column still failed loudly through checkRequiredFields,
+ * but an optional one produced a green run and a record quietly missing a
+ * field — which is the worst possible outcome for a typo.
+ */
+describe("Create reports the columns it ignored", () => {
+  test("names an unknown key and lists the columns that exist", async () => {
+    const service: DatabaseService<Monitor> = makeMonitorService();
+    const created: Monitor = new Monitor();
+    created._id = MONITOR_ID;
+    jest.spyOn(service, "create").mockResolvedValue(created as never);
+
+    const fixture: OptionsFixture = makeOptions();
+    const component: CreateOneBaseModel<Monitor> =
+      new CreateOneBaseModel<Monitor>(service);
+
+    const result: RunReturnType = await component.run(
+      { json: { name: "new monitor", descriptoin: "typo" } },
+      fixture.options,
+    );
+
+    const logged: string = loggedLines(fixture.log);
+
+    // Still a success — reporting must not start failing workflows that run today.
+    expect(result.executePort?.id).toBe("success");
+    expect(logged).toContain("descriptoin");
+    // The real column list is the fastest way to spot what was meant.
+    expect(logged).toContain("description");
+  });
+
+  test("says nothing when every key is a real column", async () => {
+    const service: DatabaseService<Monitor> = makeMonitorService();
+    jest.spyOn(service, "create").mockResolvedValue(new Monitor() as never);
+
+    const fixture: OptionsFixture = makeOptions();
+    const component: CreateOneBaseModel<Monitor> =
+      new CreateOneBaseModel<Monitor>(service);
+
+    await component.run(
+      { json: { name: "new monitor", description: "fine" } },
+      fixture.options,
+    );
+
+    expect(loggedLines(fixture.log)).not.toContain("Ignored");
+  });
+
+  /*
+   * "id" is a legitimate key even though there is no "id" column — _fromJSON
+   * rewrites it to "_id" itself. Reporting it would send the builder chasing a
+   * mistake they did not make, and "id" is the spelling the rest of the product
+   * uses.
+   */
+  test('does not report "id", which the create path accepts as an alias', async () => {
+    const service: DatabaseService<Monitor> = makeMonitorService();
+    jest.spyOn(service, "create").mockResolvedValue(new Monitor() as never);
+
+    const fixture: OptionsFixture = makeOptions();
+    const component: CreateOneBaseModel<Monitor> =
+      new CreateOneBaseModel<Monitor>(service);
+
+    await component.run(
+      { json: { id: MONITOR_ID, name: "new monitor" } },
+      fixture.options,
+    );
+
+    expect(loggedLines(fixture.log)).not.toContain("Ignored");
+  });
+
+  test("reports several unknown keys at once", async () => {
+    const service: DatabaseService<Monitor> = makeMonitorService();
+    jest.spyOn(service, "create").mockResolvedValue(new Monitor() as never);
+
+    const fixture: OptionsFixture = makeOptions();
+    const component: CreateOneBaseModel<Monitor> =
+      new CreateOneBaseModel<Monitor>(service);
+
+    await component.run(
+      { json: { name: "n", nmae: "x", desc: "y" } },
+      fixture.options,
+    );
+
+    const logged: string = loggedLines(fixture.log);
+
+    expect(logged).toContain("nmae");
+    expect(logged).toContain("desc");
+  });
+
+  /*
+   * The tenant column is stamped by the component, not typed by the builder, so
+   * checking before the stamp keeps the report about what they actually wrote.
+   */
+  test("never reports the project column the component stamps itself", async () => {
+    const service: DatabaseService<Monitor> = makeMonitorService();
+    jest.spyOn(service, "create").mockResolvedValue(new Monitor() as never);
+
+    const fixture: OptionsFixture = makeOptions();
+    const component: CreateOneBaseModel<Monitor> =
+      new CreateOneBaseModel<Monitor>(service);
+
+    await component.run({ json: { name: "n" } }, fixture.options);
+
+    expect(loggedLines(fixture.log)).not.toContain("Ignored");
+  });
+
+  test("Create Many says which element the unknown key was in", async () => {
+    const service: DatabaseService<Monitor> = makeMonitorService();
+    jest.spyOn(service, "create").mockResolvedValue(new Monitor() as never);
+
+    const fixture: OptionsFixture = makeOptions();
+    const component: CreateManyBaseModel<Monitor> =
+      new CreateManyBaseModel<Monitor>(service);
+
+    const result: RunReturnType = await component.run(
+      {
+        "json-array": [{ name: "first" }, { name: "second", nmae: "typo" }],
+      },
+      fixture.options,
+    );
+
+    const logged: string = loggedLines(fixture.log);
+
+    expect(result.executePort?.id).toBe("success");
+    expect(logged).toContain("nmae");
+    // One bad key in a long array is otherwise impossible to locate.
+    expect(logged).toContain("Item 2");
+  });
+});
+
+/*
+ * Both create components used to catch and format their own errors, and only
+ * one of them wrote to the server log. The other six database components share
+ * logComponentError, which also appends the model's real column list when the
+ * failure names a column.
+ */
+describe("Create uses the shared error logging", () => {
+  test("Create One takes the Error port and explains an unknown column", async () => {
+    const service: DatabaseService<Monitor> = makeMonitorService();
+    jest
+      .spyOn(service, "create")
+      .mockRejectedValue(
+        new Error(
+          'Property "nmae" was not found in "Monitor". Make sure your query is correct.' as never,
+        ) as never,
+      );
+
+    const fixture: OptionsFixture = makeOptions();
+    const component: CreateOneBaseModel<Monitor> =
+      new CreateOneBaseModel<Monitor>(service);
+
+    const result: RunReturnType = await component.run(
+      { json: { name: "n" } },
+      fixture.options,
+    );
+
+    const logged: string = loggedLines(fixture.log);
+
+    expect(result.executePort?.id).toBe("error");
+    expect(logged).toContain("nmae");
+    expect(logged).toContain("Columns you can use");
+    /*
+     * The Error branch of the graph has to run — onError would abort the whole
+     * run instead, which is not what an unconnected Error port should mean.
+     */
+    expect(fixture.onError).not.toHaveBeenCalled();
+  });
+
+  test("Create Many takes the Error port the same way", async () => {
+    const service: DatabaseService<Monitor> = makeMonitorService();
+    jest
+      .spyOn(service, "create")
+      .mockRejectedValue(new Error("database exploded") as never);
+
+    const fixture: OptionsFixture = makeOptions();
+    const component: CreateManyBaseModel<Monitor> =
+      new CreateManyBaseModel<Monitor>(service);
+
+    const result: RunReturnType = await component.run(
+      { "json-array": [{ name: "first" }] },
+      fixture.options,
+    );
+
+    expect(result.executePort?.id).toBe("error");
+    expect(loggedLines(fixture.log)).toContain("database exploded");
+    expect(fixture.onError).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Types/Workflow/Components/ChatWebhookComponents.test.ts

@@ -166,24 +166,54 @@ describe("Microsoft Teams SendMessageToChannel — webhook URL pin", () => {
     },
   );
 
-  test("sends to a genuine Teams webhook, with redirects off", async () => {
-    apiPostMock.mockResolvedValue(new HTTPResponse<JSONObject>(200, {}, {}));
+  const supportedTeamsWebhookUrls: Array<[string, string]> = [
+    [
+      "legacy Connector",
+      "https://outlook.office.com/webhook/abc/IncomingWebhook",
+    ],
+    [
+      "regional Logic Apps workflow",
+      "https://prod-42.westeurope.logic.azure.com:443/workflows/abc/triggers/manual/paths/invoke?api-version=2016-10-01&sig=secret",
+    ],
+    [
+      "current Power Platform workflow",
+      "https://default-1234.0a.environment.api.powerplatform.com:443/powerautomate/automations/direct/workflows/abc/triggers/manual/paths/invoke?api-version=1&sig=secret",
+    ],
+  ];
 
-    await new MicrosoftTeamsSendMessage().run(
-      {
-        text: "hi",
-        "webhook-url": "https://outlook.office.com/webhook/abc/IncomingWebhook",
-      },
-      makeOptions(),
-    );
+  test.each(supportedTeamsWebhookUrls)(
+    "sends to a genuine %s webhook with redirects off",
+    async (_label: string, webhookUrl: string) => {
+      apiPostMock.mockResolvedValue(new HTTPResponse<JSONObject>(200, {}, {}));
 
-    expect(apiPostMock).toHaveBeenCalledTimes(1);
-    const request: { options?: { doNotFollowRedirects?: boolean } } =
-      apiPostMock.mock.calls[0]![0] as {
+      await new MicrosoftTeamsSendMessage().run(
+        {
+          text: "hi",
+          "webhook-url": webhookUrl,
+        },
+        makeOptions(),
+      );
+
+      expect(apiPostMock).toHaveBeenCalledTimes(1);
+      const request: {
+        data: {
+          attachments: Array<{
+            content: { body: Array<{ wrap: boolean }> };
+          }>;
+        };
+        options?: { doNotFollowRedirects?: boolean };
+      } = apiPostMock.mock.calls[0]![0] as {
+        data: {
+          attachments: Array<{
+            content: { body: Array<{ wrap: boolean }> };
+          }>;
+        };
         options?: { doNotFollowRedirects?: boolean };
       };
-    expect(request.options?.doNotFollowRedirects).toBe(true);
-  });
+      expect(request.options?.doNotFollowRedirects).toBe(true);
+      expect(request.data.attachments[0]?.content.body[0]?.wrap).toBe(true);
+    },
+  );
 });
 
 describe("Slack SendMessageToChannel — webhook URL pin", () => {

package/Tests/Server/Types/Workflow/Components/Email.test.ts

@@ -0,0 +1,151 @@
+import Email from "../../../../../Server/Types/Workflow/Components/Email";
+import {
+  RunOptions,
+  RunReturnType,
+} from "../../../../../Server/Types/Workflow/ComponentCode";
+import Exception from "../../../../../Types/Exception/Exception";
+import { JSONObject } from "../../../../../Types/JSON";
+import ObjectID from "../../../../../Types/ObjectID";
+import nodemailer from "nodemailer";
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+
+jest.mock("nodemailer", () => {
+  return {
+    __esModule: true,
+    default: {
+      createTransport: jest.fn(),
+    },
+  };
+});
+
+interface LogSpy {
+  (item: Parameters<RunOptions["log"]>[0]): void;
+  mock: { calls: Array<Array<unknown>> };
+}
+
+interface OnErrorSpy {
+  (exception: Exception): Exception;
+  mock: { calls: Array<Array<unknown>> };
+}
+
+interface OptionsFixture {
+  options: RunOptions;
+  log: LogSpy;
+  onError: OnErrorSpy;
+}
+
+function makeOptions(): OptionsFixture {
+  const log: LogSpy = jest.fn() as unknown as LogSpy;
+  const onError: OnErrorSpy = jest.fn((exception: Exception): Exception => {
+    return exception;
+  }) as unknown as OnErrorSpy;
+
+  return {
+    log,
+    onError,
+    options: {
+      log: log,
+      workflowLogId: ObjectID.generate(),
+      workflowId: ObjectID.generate(),
+      projectId: ObjectID.generate(),
+      onError: onError,
+      executeWorkflow: async (): Promise<void> => {},
+    },
+  };
+}
+
+function validArgs(overrides: JSONObject = {}): JSONObject {
+  return {
+    from: "alerts@example.com",
+    to: "on-call@example.com",
+    subject: "Workflow alert",
+    "email-body": "Something needs attention.",
+    "smtp-host": "smtp.example.com",
+    "smtp-port": 587,
+    secure: false,
+    ...overrides,
+  };
+}
+
+const createTransportMock: ReturnType<typeof jest.fn> =
+  nodemailer.createTransport as unknown as ReturnType<typeof jest.fn>;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+describe("Email workflow component failures", () => {
+  test.each([
+    ["username only", { "smtp-username": "mailer-user" }],
+    ["password only", { "smtp-password": "super-secret-password" }],
+  ])(
+    "routes %s SMTP credentials to the Error port without logging them",
+    async (_label: string, credentials: JSONObject) => {
+      const fixture: OptionsFixture = makeOptions();
+
+      const result: RunReturnType = await new Email().run(
+        validArgs(credentials),
+        fixture.options,
+      );
+
+      const diagnostic: string =
+        "SMTP username and password must be provided together.";
+
+      expect(result.executePort?.id).toBe("error");
+      expect(result.returnValues).toEqual({ error: diagnostic });
+      expect(fixture.log).toHaveBeenCalledWith(diagnostic);
+      expect(JSON.stringify(fixture.log.mock.calls)).not.toContain(
+        "mailer-user",
+      );
+      expect(JSON.stringify(fixture.log.mock.calls)).not.toContain(
+        "super-secret-password",
+      );
+      expect(fixture.onError).not.toHaveBeenCalled();
+      expect(createTransportMock).not.toHaveBeenCalled();
+    },
+  );
+
+  test("returns a send failure diagnostic through the Error port", async () => {
+    const sendMail: ReturnType<typeof jest.fn> = jest
+      .fn()
+      .mockRejectedValue(new Error("SMTP authentication failed") as never);
+    createTransportMock.mockReturnValue({ sendMail });
+    const fixture: OptionsFixture = makeOptions();
+
+    const result: RunReturnType = await new Email().run(
+      validArgs({
+        "smtp-username": "mailer-user",
+        "smtp-password": "super-secret-password",
+      }),
+      fixture.options,
+    );
+
+    expect(result.executePort?.id).toBe("error");
+    expect(result.returnValues).toEqual({
+      error: "SMTP authentication failed",
+    });
+    expect(fixture.log).toHaveBeenCalledWith("SMTP authentication failed");
+    expect(fixture.onError).not.toHaveBeenCalled();
+    expect(sendMail).toHaveBeenCalledTimes(1);
+  });
+
+  test("still sends when username and password are both supplied", async () => {
+    const sendMail: ReturnType<typeof jest.fn> = jest
+      .fn()
+      .mockResolvedValue(undefined as never);
+    createTransportMock.mockReturnValue({ sendMail });
+    const fixture: OptionsFixture = makeOptions();
+
+    const result: RunReturnType = await new Email().run(
+      validArgs({
+        "smtp-username": "mailer-user",
+        "smtp-password": "super-secret-password",
+      }),
+      fixture.options,
+    );
+
+    expect(result.executePort?.id).toBe("success");
+    expect(result.returnValues).toEqual({});
+    expect(sendMail).toHaveBeenCalledTimes(1);
+  });
+});