@oneuptime/common 12.0.9 → 12.0.11

package/Tests/Types/API/URLUnsupportedScheme.test.ts

@@ -0,0 +1,148 @@
+import Protocol from "../../../Types/API/Protocol";
+import URL from "../../../Types/API/URL";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * An unrecognised scheme used to be swallowed: the prefix loop did not match,
+ * the protocol stayed at its https default, and the remainder was read as an
+ * authority. That is how "tel:3136361710" became the stored value
+ * "https://tel:3136361710/" — a URL nobody typed, with a host of "tel".
+ *
+ * The write side now refuses a scheme it cannot represent and says which one,
+ * instead of quietly rewriting the value into something else.
+ */
+
+describe("URL — an unsupported scheme is refused, not rewritten", () => {
+  const unsupportedSchemes: Array<string> = [
+    "ftp://files.example.com/x",
+    "file:///etc/passwd",
+    "gopher://example.com/1",
+    "ldap://example.com/x",
+    "smb://example.com/share",
+    "chrome://settings",
+    "mongodb+srv://cluster.example.com/db",
+  ];
+
+  test.each(unsupportedSchemes)("rejects %s", (input: string) => {
+    expect(() => {
+      return URL.fromString(input);
+    }).toThrow(BadDataException);
+  });
+
+  test("the error names the offending scheme", () => {
+    expect(() => {
+      return URL.fromString("ftp://files.example.com/x");
+    }).toThrow("URL scheme ftp: is not supported.");
+  });
+
+  /*
+   * These are dangerous in an href, so they are refused even without the "//"
+   * authority marker.
+   */
+  const dangerousSchemes: Array<string> = [
+    "javascript:alert(1)",
+    "javascript:alert('xss')",
+    "JavaScript:alert(1)",
+    "data:text/html,<script>alert(1)</script>",
+    "data:text/plain,hello",
+    "vbscript:msgbox(1)",
+    "file:/etc/passwd",
+    "blob:https://example.com/uuid",
+  ];
+
+  test.each(dangerousSchemes)("rejects %s", (input: string) => {
+    expect(() => {
+      return URL.fromString(input);
+    }).toThrow(BadDataException);
+  });
+
+  /*
+   * The specific hole this closes: a scheme whose remainder happens to look
+   * like a valid host:port used to sail through and be silently rewritten.
+   */
+  test("an unsupported scheme with a port-shaped remainder is refused", () => {
+    expect(() => {
+      return URL.fromString("javascript:12345");
+    }).toThrow(BadDataException);
+  });
+
+  test("no unsupported scheme is silently rewritten to https", () => {
+    for (const input of [...unsupportedSchemes, ...dangerousSchemes]) {
+      let rewritten: string | null = null;
+
+      try {
+        rewritten = URL.fromString(input).toString();
+      } catch {
+        // Refused, which is the point.
+      }
+
+      expect(rewritten).toBeNull();
+    }
+  });
+});
+
+describe("URL — scheme rejection does not catch things that are not schemes", () => {
+  /*
+   * "example.com:8080/hook" has no scheme — that colon separates a host from a
+   * port. A regex alone cannot tell the two apart, so the rule keys on the
+   * "//" authority marker, which a host:port never has.
+   */
+  const schemeLessValues: Array<[string, string]> = [
+    ["example.com:8080/hook", "example.com:8080"],
+    ["localhost:5000", "localhost:5000"],
+    ["example.com", "example.com"],
+    ["status.example.com/path", "status.example.com"],
+  ];
+
+  test.each(schemeLessValues)(
+    "%s is still parsed as a host, not a scheme",
+    (input: string, expectedHost: string) => {
+      const url: URL = URL.fromString(input);
+
+      expect(url.protocol).toBe(Protocol.HTTPS);
+      expect(url.hostname.toString()).toBe(expectedHost);
+    },
+  );
+
+  test("every supported scheme still parses", () => {
+    const supported: Array<[string, Protocol]> = [
+      ["https://example.com/x", Protocol.HTTPS],
+      ["http://example.com/x", Protocol.HTTP],
+      ["ws://example.com/x", Protocol.WS],
+      ["wss://example.com/x", Protocol.WSS],
+      ["mongodb://example.com/db", Protocol.MONGO_DB],
+      ["mailto:support@example.com", Protocol.MAIL],
+      ["tel:+13136361710", Protocol.TEL],
+      ["sms:+15555550123", Protocol.SMS],
+    ];
+
+    for (const [input, expected] of supported) {
+      expect(URL.fromString(input).protocol).toBe(expected);
+    }
+  });
+});
+
+/*
+ * The read side is unaffected: a value already sitting in the database with an
+ * unsupported scheme still comes back, flagged, rather than failing the query
+ * that touched it.
+ */
+describe("URL — reads still tolerate an unsupported scheme already stored", () => {
+  test("fromStringLenient keeps a stored ftp:// link readable", () => {
+    const url: URL = URL.fromStringLenient("ftp://files.example.com/x");
+
+    expect(url.isMalformed()).toBe(true);
+    expect(url.toString()).toBe("ftp://files.example.com/x");
+  });
+
+  test("but it can never be written back", () => {
+    const transformer: {
+      to: (value: unknown) => unknown;
+    } = URL.getDatabaseTransformer() as { to: (value: unknown) => unknown };
+
+    expect(() => {
+      return transformer.to(URL.fromStringLenient("ftp://files.example.com/x"));
+    }).toThrow(BadDataException);
+  });
+});

package/Tests/Types/Billing/PayAsYouGoPricing.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from "@jest/globals";
+import {
+  ACTIVE_MONITOR_PRICE_IN_USD_PER_MONTH,
+  PRICING_PAGE_URL,
+  SESSION_REPLAY_PRICE_IN_USD_PER_GB,
+  TELEMETRY_PRICE_IN_USD_PER_GB,
+  TELEMETRY_PRICE_RETENTION_IN_DAYS,
+  formatPriceInUSD,
+} from "../../../Types/Billing/PayAsYouGoPricing";
+
+/*
+ * These constants are quoted to users, verbatim, on the telemetry ingestion
+ * key and create monitor pages. They are pinned here because changing one
+ * silently changes what the product promises a customer - a change to any of
+ * them has to be deliberate, and has to be made on the pricing page too.
+ */
+
+describe("PayAsYouGoPricing", () => {
+  describe("rates", () => {
+    it("charges $0.10 per GB of telemetry, quoted for 15 day retention", () => {
+      expect(TELEMETRY_PRICE_IN_USD_PER_GB).toBe(0.1);
+      expect(TELEMETRY_PRICE_RETENTION_IN_DAYS).toBe(15);
+    });
+
+    it("charges $2 per GB for session replay, on the same 15 day window", () => {
+      expect(SESSION_REPLAY_PRICE_IN_USD_PER_GB).toBe(2);
+    });
+
+    it("charges $1 per active monitor per month", () => {
+      expect(ACTIVE_MONITOR_PRICE_IN_USD_PER_MONTH).toBe(1);
+    });
+
+    it("points at the public pricing page", () => {
+      expect(PRICING_PAGE_URL).toBe("https://oneuptime.com/pricing");
+    });
+  });
+
+  describe("formatPriceInUSD", () => {
+    it("writes a whole number of dollars without cents, like the pricing page", () => {
+      expect(formatPriceInUSD(1)).toBe("$1");
+      expect(formatPriceInUSD(22)).toBe("$22");
+      expect(formatPriceInUSD(0)).toBe("$0");
+    });
+
+    it("writes a fractional amount with two decimal places", () => {
+      expect(formatPriceInUSD(0.1)).toBe("$0.10");
+      expect(formatPriceInUSD(1.5)).toBe("$1.50");
+      expect(formatPriceInUSD(2.05)).toBe("$2.05");
+    });
+
+    it("rounds to cents rather than spilling extra digits into the copy", () => {
+      expect(formatPriceInUSD(0.125)).toBe("$0.13");
+      expect(formatPriceInUSD(0.006)).toBe("$0.01");
+    });
+
+    it("renders the advertised rates exactly as the pricing page writes them", () => {
+      expect(formatPriceInUSD(TELEMETRY_PRICE_IN_USD_PER_GB)).toBe("$0.10");
+      expect(formatPriceInUSD(SESSION_REPLAY_PRICE_IN_USD_PER_GB)).toBe("$2");
+      expect(formatPriceInUSD(ACTIVE_MONITOR_PRICE_IN_USD_PER_MONTH)).toBe(
+        "$1",
+      );
+    });
+  });
+});

package/Tests/Types/CustomField/CustomFieldTypeCorrespondence.test.ts

@@ -0,0 +1,107 @@
+import CustomFieldType from "../../../Types/CustomField/CustomFieldType";
+import FormFieldSchemaType from "../../../UI/Components/Forms/Types/FormFieldSchemaType";
+import FieldType from "../../../UI/Components/Types/FieldType";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * CustomFieldsDetail does not translate a definition's `customFieldType` into a
+ * render type - it hands the raw string to a Detail field and to a form field
+ * as their `fieldType`, through an `as any` that erases the enum on the way.
+ * Nothing in the compiler is watching that seam, so a member added here without
+ * a same-VALUE member in FieldType and FormFieldSchemaType type-checks, builds,
+ * ships, and only then shows itself: the Detail column falls off the end of the
+ * render switch and paints an empty cell, and the form falls off the end of the
+ * input switch and paints a control the user cannot type into. The field looks
+ * present and is silently unusable, which is the worst shape a regression can
+ * take because nothing throws and nothing logs.
+ *
+ * These are value-set comparisons rather than key comparisons on purpose. The
+ * three enums are free to spell a member however reads best on their own side -
+ * `Boolean` reaches the form as `FormFieldSchemaType.Toggle`, which is written
+ * `Toggle = "Boolean"` for exactly this reason - and only the value crosses the
+ * seam. A key-based check would both miss real breakage and reject that legal
+ * spelling.
+ */
+
+const customFieldTypeEntries: Array<[string, string]> = Object.entries(
+  CustomFieldType,
+) as Array<[string, string]>;
+
+const fieldTypeValues: Set<string> = new Set<string>(
+  Object.values(FieldType) as Array<string>,
+);
+
+const formFieldSchemaTypeValues: Set<string> = new Set<string>(
+  Object.values(FormFieldSchemaType) as Array<string>,
+);
+
+describe("CustomFieldType corresponds to FieldType", () => {
+  test.each(customFieldTypeEntries)(
+    "CustomFieldType.%s is a FieldType value",
+    (_key: string, value: string) => {
+      expect(fieldTypeValues.has(value)).toBe(true);
+    },
+  );
+});
+
+describe("CustomFieldType corresponds to FormFieldSchemaType", () => {
+  test.each(customFieldTypeEntries)(
+    "CustomFieldType.%s is a FormFieldSchemaType value",
+    (_key: string, value: string) => {
+      expect(formFieldSchemaTypeValues.has(value)).toBe(true);
+    },
+  );
+});
+
+describe("CustomFieldType member set", () => {
+  test("has at least one member so the correspondence loops cannot pass vacuously", () => {
+    /*
+     * The two blocks above are generated from this enum. If it were ever
+     * emptied - a bad merge, a barrel file re-export that resolves to {} - the
+     * per-member assertions would simply stop existing and the suite would go
+     * green while guarding nothing.
+     */
+    expect(customFieldTypeEntries.length).toBeGreaterThan(0);
+  });
+
+  test("has no duplicate values", () => {
+    /*
+     * Two keys sharing a value collapse at runtime: the second one wins every
+     * lookup, and a definition saved under the first key renders as the second
+     * one's type. It also makes the loops above lie, because a duplicate is
+     * checked twice and the shadowed member is never exercised on its own.
+     */
+    const values: Array<string> = customFieldTypeEntries.map(
+      ([, value]: [string, string]) => {
+        return value;
+      },
+    );
+
+    expect(new Set<string>(values).size).toBe(values.length);
+  });
+
+  test("includes Date and DateTime", () => {
+    /*
+     * The date members are what the jsonb range filters and the ISO-8601
+     * storage format exist for. Losing them is a silent feature removal - old
+     * definitions keep their stored `customFieldType` string in the database
+     * and would then fall through every switch that reads this enum.
+     */
+    expect(CustomFieldType.Date).toEqual("Date");
+    expect(CustomFieldType.DateTime).toEqual("DateTime");
+  });
+});
+
+describe("CustomFieldType correspondence is by value, not by key", () => {
+  test("Boolean reaches the form as Toggle, which is only visible by value", () => {
+    /*
+     * This is the case that proves the checks above have to compare values.
+     * FormFieldSchemaType has no member named `Boolean`; it names the same
+     * value `Toggle`. A correspondence test written against key names would
+     * fail here on code that works perfectly, and would then be "fixed" by
+     * relaxing it into something that no longer catches a missing member.
+     */
+    expect(Object.keys(FormFieldSchemaType)).not.toContain("Boolean");
+    expect(FormFieldSchemaType.Toggle).toEqual(CustomFieldType.Boolean);
+  });
+});

package/Tests/Types/Monitor/MonitorType.test.ts

@@ -253,6 +253,68 @@ describe("MonitorTypeHelper", () => {
     });
   });
 
+  /*
+   * The dashboard tells Free plan users which monitors cost money before they
+   * create one, and gates the create button on acknowledging it. That warning
+   * is only honest while this predicate agrees with what the server actually
+   * meters - ActiveMonitoringMeteredPlan counts every monitor whose type is
+   * not Manual.
+   */
+  describe("isBilledAsActiveMonitor", () => {
+    test("Manual monitors are free", () => {
+      expect(
+        MonitorTypeHelper.isBilledAsActiveMonitor(MonitorType.Manual),
+      ).toBe(false);
+    });
+
+    test("every other monitor type is billed", () => {
+      const billed: Array<MonitorType> = Object.values(MonitorType).filter(
+        (monitorType: MonitorType) => {
+          return monitorType !== MonitorType.Manual;
+        },
+      );
+
+      expect(billed.length).toBeGreaterThan(0);
+
+      for (const monitorType of billed) {
+        expect(MonitorTypeHelper.isBilledAsActiveMonitor(monitorType)).toBe(
+          true,
+        );
+      }
+    });
+
+    test("telemetry monitors are billed as active monitors too, on top of their ingest", () => {
+      expect(MonitorTypeHelper.isBilledAsActiveMonitor(MonitorType.Logs)).toBe(
+        true,
+      );
+      expect(
+        MonitorTypeHelper.isBilledAsActiveMonitor(MonitorType.Metrics),
+      ).toBe(true);
+      expect(
+        MonitorTypeHelper.isBilledAsActiveMonitor(MonitorType.Traces),
+      ).toBe(true);
+    });
+
+    test("agrees exactly with getActiveMonitorTypes", () => {
+      const active: Array<MonitorType> =
+        MonitorTypeHelper.getActiveMonitorTypes();
+
+      for (const monitorType of Object.values(MonitorType)) {
+        expect(MonitorTypeHelper.isBilledAsActiveMonitor(monitorType)).toBe(
+          active.includes(monitorType),
+        );
+      }
+    });
+
+    test("is the exact inverse of isManualMonitor", () => {
+      for (const monitorType of Object.values(MonitorType)) {
+        expect(MonitorTypeHelper.isBilledAsActiveMonitor(monitorType)).toBe(
+          !MonitorTypeHelper.isManualMonitor(monitorType),
+        );
+      }
+    });
+  });
+
   describe("doesMonitorTypeHaveGraphs", () => {
     test("returns true for graphable types and false otherwise", () => {
       expect(

package/Tests/Types/NetworkAutomation/RuleRunResult.test.ts

@@ -0,0 +1,184 @@
+import {
+  LabelRuleRunResult,
+  RuleRunResultUtil,
+  SiteAssignmentRuleRunResult,
+} from "../../../Types/NetworkAutomation/RuleRunResult";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test - narrowing a rule run's response.
+ *
+ * The dashboard renders these counters straight into a sentence, so anything
+ * the parser lets through untyped ends up on screen. A field the server did
+ * not send has to read as zero, not as "NaN devices"; isTruncated has to be a
+ * real boolean, not whatever truthy value happened to arrive.
+ */
+
+describe("RuleRunResultUtil.parseSiteAssignmentRuleRunResult", () => {
+  it("reads a full response", () => {
+    const parsed: SiteAssignmentRuleRunResult =
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult({
+        devicesEvaluated: 40,
+        devicesMatched: 12,
+        devicesAssigned: 8,
+        devicesAlreadyInRuleSite: 2,
+        devicesSkippedAlreadyInAnotherSite: 1,
+        devicesClaimedByHigherPriorityRule: 1,
+        devicesFailed: 0,
+        isTruncated: false,
+      } as JSONObject);
+
+    expect(parsed).toEqual({
+      devicesEvaluated: 40,
+      devicesMatched: 12,
+      devicesAssigned: 8,
+      devicesAlreadyInRuleSite: 2,
+      devicesSkippedAlreadyInAnotherSite: 1,
+      devicesClaimedByHigherPriorityRule: 1,
+      devicesFailed: 0,
+      isTruncated: false,
+    });
+  });
+
+  it("reads every missing counter as zero", () => {
+    const parsed: SiteAssignmentRuleRunResult =
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult({});
+
+    expect(parsed).toEqual({
+      devicesEvaluated: 0,
+      devicesMatched: 0,
+      devicesAssigned: 0,
+      devicesAlreadyInRuleSite: 0,
+      devicesSkippedAlreadyInAnotherSite: 0,
+      devicesClaimedByHigherPriorityRule: 0,
+      devicesFailed: 0,
+      isTruncated: false,
+    });
+  });
+
+  it("survives a null or undefined body", () => {
+    expect(
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult(null).devicesEvaluated,
+    ).toBe(0);
+    expect(
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult(undefined)
+        .devicesMatched,
+    ).toBe(0);
+  });
+
+  /*
+   * A numeric string is exactly what a hand-rolled proxy or a JSON layer that
+   * stringifies large numbers would send. It must not become "12" concatenated
+   * into a sentence, nor NaN.
+   */
+  it("refuses a non-numeric counter rather than passing it through", () => {
+    const parsed: SiteAssignmentRuleRunResult =
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult({
+        devicesEvaluated: "40",
+        devicesMatched: null,
+        devicesAssigned: {},
+      } as unknown as JSONObject);
+
+    expect(parsed.devicesEvaluated).toBe(0);
+    expect(parsed.devicesMatched).toBe(0);
+    expect(parsed.devicesAssigned).toBe(0);
+  });
+
+  it("refuses NaN and Infinity", () => {
+    const parsed: SiteAssignmentRuleRunResult =
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult({
+        devicesEvaluated: Number.NaN,
+        devicesMatched: Number.POSITIVE_INFINITY,
+      } as unknown as JSONObject);
+
+    expect(parsed.devicesEvaluated).toBe(0);
+    expect(parsed.devicesMatched).toBe(0);
+  });
+
+  it("treats only a literal true as truncation", () => {
+    expect(
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult({
+        isTruncated: true,
+      }).isTruncated,
+    ).toBe(true);
+
+    expect(
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult({
+        isTruncated: "true",
+      } as unknown as JSONObject).isTruncated,
+    ).toBe(false);
+
+    expect(
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult({
+        isTruncated: 1,
+      } as unknown as JSONObject).isTruncated,
+    ).toBe(false);
+  });
+
+  // Unknown fields are dropped: the shape the UI reads is the declared one.
+  it("ignores fields it does not know", () => {
+    const parsed: SiteAssignmentRuleRunResult =
+      RuleRunResultUtil.parseSiteAssignmentRuleRunResult({
+        devicesEvaluated: 3,
+        somethingElse: "ignored",
+      } as unknown as JSONObject);
+
+    expect(parsed.devicesEvaluated).toBe(3);
+    expect(Object.keys(parsed)).not.toContain("somethingElse");
+  });
+});
+
+describe("RuleRunResultUtil.parseLabelRuleRunResult", () => {
+  it("reads a full response", () => {
+    const parsed: LabelRuleRunResult =
+      RuleRunResultUtil.parseLabelRuleRunResult({
+        devicesEvaluated: 40,
+        devicesMatched: 12,
+        devicesLabeled: 10,
+        labelsAttached: 20,
+        labelsFailed: 0,
+        isTruncated: true,
+      } as JSONObject);
+
+    expect(parsed).toEqual({
+      devicesEvaluated: 40,
+      devicesMatched: 12,
+      devicesLabeled: 10,
+      labelsAttached: 20,
+      labelsFailed: 0,
+      isTruncated: true,
+    });
+  });
+
+  it("reads every missing counter as zero", () => {
+    const parsed: LabelRuleRunResult =
+      RuleRunResultUtil.parseLabelRuleRunResult({});
+
+    expect(parsed).toEqual({
+      devicesEvaluated: 0,
+      devicesMatched: 0,
+      devicesLabeled: 0,
+      labelsAttached: 0,
+      labelsFailed: 0,
+      isTruncated: false,
+    });
+  });
+
+  it("survives a null body", () => {
+    expect(RuleRunResultUtil.parseLabelRuleRunResult(null).labelsAttached).toBe(
+      0,
+    );
+  });
+
+  it("refuses a non-numeric counter", () => {
+    const parsed: LabelRuleRunResult =
+      RuleRunResultUtil.parseLabelRuleRunResult({
+        labelsAttached: "20",
+        devicesLabeled: false,
+      } as unknown as JSONObject);
+
+    expect(parsed.labelsAttached).toBe(0);
+    expect(parsed.devicesLabeled).toBe(0);
+  });
+});