@oneuptime/common 13.0.0 → 13.0.1

package/Tests/Models/RunnerVersionLabel.test.ts

@@ -25,7 +25,7 @@
  * So this file pins BOTH halves. The title/description assertions fail if
  * someone reverts the wording; the property/column assertions fail if someone
  * "finishes the job" by renaming the field, which is the change that would take
- * production down quietly. The final describe pins that the eleven unrelated
+ * production down quietly. The final describe pins that the twelve unrelated
  * monitoring-agent models were NOT swept up in the rename.
  * ---------------------------------------------------------------------------
  */
@@ -42,6 +42,7 @@ import ProxmoxCluster from "../../Models/DatabaseModels/ProxmoxCluster";
 import Runner from "../../Models/DatabaseModels/Runner";
 import RumApplication from "../../Models/DatabaseModels/RumApplication";
 import ServerlessFunction from "../../Models/DatabaseModels/ServerlessFunction";
+import VMwareVCenter from "../../Models/DatabaseModels/VMwareVCenter";
 import DatabaseBaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import { TableColumnMetadata } from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
@@ -171,7 +172,7 @@ describe("Runner.agentVersion column contract (must NOT be renamed)", () => {
 });
 
 /*
- * The eleven models below are real monitoring agents / SDKs reporting the
+ * The twelve models below are real monitoring agents / SDKs reporting the
  * version of software OneUptime ships onto a customer host. "Agent Version" is
  * correct for all of them. A find-and-replace across the repo would have
  * renamed them too, so each one is pinned by name — a bulk rename fails here
@@ -193,6 +194,7 @@ describe("unrelated monitoring-agent models keep saying 'Agent Version'", () =>
     { name: "IoTFleet", model: IoTFleet },
     { name: "RumApplication", model: RumApplication },
     { name: "ServerlessFunction", model: ServerlessFunction },
+    { name: "VMwareVCenter", model: VMwareVCenter },
   ];
 
   test.each(AGENT_MODELS)(

package/Tests/Server/API/AIChatProvidersAIEnabled.test.ts

@@ -0,0 +1,259 @@
+import { mockRouter } from "./Helpers";
+import "../../../Server/API/AIChatAPI";
+import CommonAPI from "../../../Server/API/CommonAPI";
+import LlmProviderService from "../../../Server/Services/LlmProviderService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import LlmProvider from "../../../Models/DatabaseModels/LlmProvider";
+import Project from "../../../Models/DatabaseModels/Project";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Dictionary from "../../../Types/Dictionary";
+import { JSONObject } from "../../../Types/JSON";
+import LlmType from "../../../Types/LLM/LlmType";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendJsonObjectResponse: jest.fn(),
+  };
+});
+
+/*
+ * Ask AI used to look perfectly ready on a project with AI switched off. The
+ * header button opened a composer, the suggested prompts were clickable, and
+ * the only thing that ever mentioned the switch was the red banner that
+ * appeared AFTER the user had written a question and pressed send — telling
+ * them, at that point, to go and find a settings page.
+ *
+ * The client cannot know the answer on its own: Project.enableAi is a server
+ * row, and the chat surfaces deliberately hold no project model. So the
+ * verdict rides along on POST /ai-chat/providers, which every chat surface
+ * already calls as it opens. That is what this suite pins:
+ *
+ *   - the field is reported, and reported honestly (the toggle's three states
+ *     are true / undefined-because-unselected / false, not two);
+ *   - it fails CLOSED on a project row we cannot read, matching the
+ *     server-side gate in AIService rather than contradicting it; and
+ *   - it does not cost a request of its own, because a second round trip is
+ *     exactly how this ends up back where it started.
+ *
+ * The refusal itself still lives in AIService.executeWithLogging and in the
+ * send-message route (Common/Tests/Server/API/AIKillSwitchBackstop). Nothing
+ * here is a security boundary — it is what the user is TOLD, before typing.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+
+const USER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+
+const PROVIDER_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+
+const PROVIDERS_ROUTE: string = "/ai-chat/providers";
+
+function memberProps(): DatabaseCommonInteractionProps {
+  const permissions: Array<UserPermission> = [
+    Permission.ProjectMember,
+    Permission.ReadProjectLlm,
+  ].map((permission: Permission) => {
+    return {
+      _type: "UserPermission",
+      permission: permission,
+      labelIds: [],
+      isBlockPermission: false,
+    } as UserPermission;
+  });
+
+  const dictionary: Dictionary<UserTenantAccessPermission> = {};
+  dictionary[PROJECT_ID.toString()] = {
+    _type: "UserTenantAccessPermission",
+    projectId: PROJECT_ID,
+    permissions: permissions,
+    isBlockPermission: false,
+  } as UserTenantAccessPermission;
+
+  return {
+    userId: USER_ID,
+    tenantId: PROJECT_ID,
+    userTenantAccessPermission: dictionary,
+  };
+}
+
+function provider(): LlmProvider {
+  const llmProvider: LlmProvider = new LlmProvider(PROVIDER_ID);
+  llmProvider.name = "project-gpt";
+  llmProvider.llmType = LlmType.OpenAI;
+  llmProvider.modelName = "gpt-4o";
+  llmProvider.isDefault = true;
+  llmProvider.projectId = PROJECT_ID;
+  return llmProvider;
+}
+
+/*
+ * `enableAi` is deliberately typed as optional on the model: the column is NOT
+ * NULL DEFAULT true, so a row selected without that column arrives undefined,
+ * and undefined has always meant "not selected", never "off".
+ */
+function projectRow(enableAi: boolean | undefined): Project {
+  const project: Project = new Project(PROJECT_ID);
+
+  // Left unset, not set to undefined — that is what an unselected column is.
+  if (enableAi !== undefined) {
+    project.enableAi = enableAi;
+  }
+
+  return project;
+}
+
+async function callProviders(): Promise<void> {
+  const next: ReturnType<typeof jest.fn> = jest.fn();
+
+  await mockRouter.match("post", PROVIDERS_ROUTE).handlerFunction(
+    {
+      body: {},
+      headers: {},
+      params: {},
+      query: {},
+    } as unknown as ExpressRequest,
+    {} as ExpressResponse,
+    next as unknown as NextFunction,
+  );
+
+  const thrown: unknown = next.mock.calls[0]?.[0];
+
+  if (thrown) {
+    throw thrown;
+  }
+}
+
+function sentPayload(): JSONObject {
+  const send: jest.Mock =
+    Response.sendJsonObjectResponse as unknown as jest.Mock;
+  return send.mock.calls[0]![2] as JSONObject;
+}
+
+function stubProject(project: Project | null): void {
+  jest.spyOn(ProjectService, "findOneById").mockResolvedValue(project);
+}
+
+beforeEach(() => {
+  jest.restoreAllMocks();
+  jest.clearAllMocks();
+
+  jest
+    .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+    .mockResolvedValue(memberProps());
+  jest
+    .spyOn(LlmProviderService, "getSelectableProvidersForProject")
+    .mockResolvedValue([provider()]);
+  jest
+    .spyOn(LlmProviderService, "getLLMProviderForProject")
+    .mockResolvedValue(provider());
+  stubProject(projectRow(true));
+});
+
+describe("POST /ai-chat/providers reports the project's AI kill switch", () => {
+  test("a project with AI on is reported as enabled", async () => {
+    stubProject(projectRow(true));
+
+    await callProviders();
+
+    expect(sentPayload()["isAIEnabledForProject"]).toBe(true);
+  });
+
+  test("a project with AI explicitly off is reported as disabled", async () => {
+    stubProject(projectRow(false));
+
+    await callProviders();
+
+    expect(sentPayload()["isAIEnabledForProject"]).toBe(false);
+  });
+
+  test("undefined means 'not selected', not 'off' — the column defaults to true", async () => {
+    stubProject(projectRow(undefined));
+
+    await callProviders();
+
+    expect(sentPayload()["isAIEnabledForProject"]).toBe(true);
+  });
+
+  test("a project row that cannot be read answers 'disabled' — the same way the server-side gate fails closed", async () => {
+    stubProject(null);
+
+    await callProviders();
+
+    expect(sentPayload()["isAIEnabledForProject"]).toBe(false);
+  });
+
+  test("the verdict is read for the caller's own project", async () => {
+    await callProviders();
+
+    expect(ProjectService.findOneById).toHaveBeenCalledWith(
+      expect.objectContaining({ id: PROJECT_ID }),
+    );
+  });
+
+  test("only the toggle column is selected — no other project data is pulled to answer this", async () => {
+    await callProviders();
+
+    const call: JSONObject = (
+      ProjectService.findOneById as unknown as jest.Mock
+    ).mock.calls[0]![0] as JSONObject;
+
+    expect(call["select"]).toEqual({ enableAi: true });
+  });
+
+  test("the switch costs no extra round trip — it rides on the request the picker already makes", async () => {
+    await callProviders();
+
+    const payload: JSONObject = sentPayload();
+
+    // One response, carrying the providers AND the verdict.
+    expect(Response.sendJsonObjectResponse).toHaveBeenCalledTimes(1);
+    expect(payload).toHaveProperty("isAIEnabledForProject");
+    expect(payload).toHaveProperty("providers");
+    expect(payload).toHaveProperty("defaultProviderId");
+  });
+
+  test("a disabled project still gets its provider list — the notice explains, it does not hide the setup", async () => {
+    stubProject(projectRow(false));
+
+    await callProviders();
+
+    const payload: JSONObject = sentPayload();
+
+    expect(payload["isAIEnabledForProject"]).toBe(false);
+    expect((payload["providers"] as Array<JSONObject>).length).toBe(1);
+  });
+
+  test("the toggle read never carries the caller's props — it is a root read of one boolean", async () => {
+    await callProviders();
+
+    const call: JSONObject = (
+      ProjectService.findOneById as unknown as jest.Mock
+    ).mock.calls[0]![0] as JSONObject;
+
+    expect(call["props"]).toEqual({ isRoot: true });
+  });
+});

package/Tests/Server/API/AIChatRouteAuthorization.test.ts

@@ -13,6 +13,7 @@ import {
 } from "../../../Server/Utils/Express";
 import Response from "../../../Server/Utils/Response";
 import LlmProvider from "../../../Models/DatabaseModels/LlmProvider";
+import Project from "../../../Models/DatabaseModels/Project";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
@@ -266,6 +267,18 @@ function victimProvider(): LlmProvider {
   return provider;
 }
 
+/*
+ * The provider listing also reports the project's AI kill switch, so the chat
+ * surfaces can say why they are unavailable before a question is typed. The
+ * default row here has AI on, which is what every authorization case above
+ * assumes; AIChatProvidersAIEnabled.test.ts owns the switch itself.
+ */
+function projectWithAI(enableAi: boolean): Project {
+  const project: Project = new Project(PROJECT_B_ID);
+  project.enableAi = enableAi;
+  return project;
+}
+
 function stubProviderLookups(): void {
   jest
     .spyOn(LlmProviderService, "getSelectableProvidersForProject")
@@ -273,6 +286,9 @@ function stubProviderLookups(): void {
   jest
     .spyOn(LlmProviderService, "getLLMProviderForProject")
     .mockResolvedValue(victimProvider());
+  jest
+    .spyOn(ProjectService, "findOneById")
+    .mockResolvedValue(projectWithAI(true));
 }
 
 function providerLookupsRan(): boolean {
@@ -280,8 +296,21 @@ function providerLookupsRan(): boolean {
     LlmProviderService.getSelectableProvidersForProject as unknown as jest.Mock;
   const forProject: jest.Mock =
     LlmProviderService.getLLMProviderForProject as unknown as jest.Mock;
-
-  return selectable.mock.calls.length > 0 || forProject.mock.calls.length > 0;
+  /*
+   * The project read that reports the AI kill switch sits in the same
+   * Promise.all as the two provider reads, and it is root-privileged on the
+   * header's project id — exactly the shape the advisory was about. It counts
+   * as a lookup, so "nothing was queried for the victim project" keeps meaning
+   * what it says.
+   */
+  const projectRead: jest.Mock =
+    ProjectService.findOneById as unknown as jest.Mock;
+
+  return (
+    selectable.mock.calls.length > 0 ||
+    forProject.mock.calls.length > 0 ||
+    projectRead.mock.calls.length > 0
+  );
 }
 
 beforeEach(() => {

package/Tests/Server/API/BillingPayAsYouGoStatus.test.ts

@@ -0,0 +1,116 @@
+import BillingAPI from "../../../Server/API/BillingAPI";
+import PayAsYouGoBillingService from "../../../Server/Services/PayAsYouGoBillingService";
+import {
+  NextFunction,
+  OneUptimeRequest,
+  OneUptimeResponse,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, { UserPermission } from "../../../Types/Permission";
+import { mockRouter } from "./Helpers";
+
+jest.mock("../../../Server/Services/BillingService", () => {
+  return { __esModule: true, default: {} };
+});
+jest.mock("../../../Server/Services/ProjectService", () => {
+  return { __esModule: true, default: {} };
+});
+jest.mock("../../../Server/API/CommonAPI", () => {
+  return { __esModule: true, default: {} };
+});
+jest.mock("../../../Server/Middleware/UserAuthorization", () => {
+  return { __esModule: true, default: { getUserMiddleware: jest.fn() } };
+});
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+jest.mock("../../../Server/Services/PayAsYouGoBillingService", () => {
+  return { __esModule: true, default: { canUsePayAsYouGo: jest.fn() } };
+});
+jest.mock("../../../Server/Utils/Response", () => {
+  return { __esModule: true, default: { sendJsonObjectResponse: jest.fn() } };
+});
+
+describe("GET /billing/pay-as-you-go-status", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  let req: OneUptimeRequest;
+  let res: OneUptimeResponse;
+  let next: NextFunction;
+
+  const requestStatus: () => Promise<void> = async (): Promise<void> => {
+    await mockRouter
+      .match("get", "/billing/pay-as-you-go-status")
+      .handlerFunction(req, res, next);
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    new BillingAPI();
+    req = { tenantId: projectId } as OneUptimeRequest;
+    res = {} as OneUptimeResponse;
+    next = jest.fn();
+    jest
+      .spyOn(BillingAPI.prototype, "getPermissionsForTenant")
+      .mockResolvedValue([
+        { permission: Permission.ProjectMember } as UserPermission,
+      ]);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it.each([true, false])(
+    "returns only the feature eligibility (%s) to a project member",
+    async (isAllowed: boolean) => {
+      jest
+        .mocked(PayAsYouGoBillingService.canUsePayAsYouGo)
+        .mockResolvedValue(isAllowed);
+      await requestStatus();
+      expect(PayAsYouGoBillingService.canUsePayAsYouGo).toHaveBeenCalledWith(
+        projectId,
+      );
+      expect(Response.sendJsonObjectResponse).toHaveBeenCalledWith(req, res, {
+        isAllowed,
+      });
+      expect(next).not.toHaveBeenCalled();
+    },
+  );
+
+  it("requires a selected project", async () => {
+    req = {} as OneUptimeRequest;
+    await requestStatus();
+    expect(next).toHaveBeenCalledWith(
+      expect.objectContaining({ message: "Project ID is required" }),
+    );
+    expect(PayAsYouGoBillingService.canUsePayAsYouGo).not.toHaveBeenCalled();
+  });
+
+  it("requires project membership", async () => {
+    jest
+      .spyOn(BillingAPI.prototype, "getPermissionsForTenant")
+      .mockResolvedValue([]);
+    await requestStatus();
+    expect(next).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message: "You do not have access to this project",
+      }),
+    );
+    expect(PayAsYouGoBillingService.canUsePayAsYouGo).not.toHaveBeenCalled();
+  });
+
+  it("propagates provider failures instead of incorrectly granting access", async () => {
+    const error: Error = new Error("Billing unavailable");
+    jest
+      .mocked(PayAsYouGoBillingService.canUsePayAsYouGo)
+      .mockRejectedValue(error);
+    await requestStatus();
+    expect(next).toHaveBeenCalledWith(error);
+    expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/API/DashboardPublicResourceListAPI.test.ts

@@ -17,6 +17,7 @@ import PodmanResourceService from "../../../Server/Services/PodmanResourceServic
 import ProxmoxResourceService from "../../../Server/Services/ProxmoxResourceService";
 import ServiceLevelObjectiveService from "../../../Server/Services/ServiceLevelObjectiveService";
 import SpanService from "../../../Server/Services/SpanService";
+import VMwareResourceService from "../../../Server/Services/VMwareResourceService";
 import PublicDashboardResourceListPolicy, {
   BuildPublicDashboardResourceListPolicyData,
   PublicDashboardResourceListPolicyResult,
@@ -266,6 +267,18 @@ const RESOURCE_ROUTE_CASES: Array<ResourceRouteCase> = [
     service: ProxmoxResourceService,
     kind: "Guest",
   },
+  {
+    resourceType: "vmware-resource",
+    componentType: DashboardComponentType.VMwareHostList,
+    service: VMwareResourceService,
+    kind: "Host",
+  },
+  {
+    resourceType: "vmware-resource",
+    componentType: DashboardComponentType.VMwareVirtualMachineList,
+    service: VMwareResourceService,
+    kind: "VirtualMachine",
+  },
   {
     resourceType: "ceph-resource",
     componentType: DashboardComponentType.CephOsdList,
@@ -323,6 +336,7 @@ const ALL_SERVICES: Array<ListService> = [
   PodmanHostService,
   PodmanResourceService,
   ProxmoxResourceService,
+  VMwareResourceService,
   CephResourceService,
   DockerSwarmResourceService,
   SpanService,
@@ -520,7 +534,7 @@ describe("DashboardAPI public resource-list", () => {
       }
     });
 
-    it("does not return sibling-only Proxmox or Swarm fields", async () => {
+    it("does not return sibling-only Proxmox, VMware or Swarm fields", async () => {
       const cases: Array<{
         resourceType: string;
         componentType: DashboardComponentType;
@@ -542,6 +556,20 @@ describe("DashboardAPI public resource-list", () => {
           included: "latestCpuPercent",
           excluded: "vmid",
         },
+        {
+          resourceType: "vmware-resource",
+          componentType: DashboardComponentType.VMwareVirtualMachineList,
+          service: VMwareResourceService,
+          included: "isPoweredOn",
+          excluded: "cpuCapacityMhz",
+        },
+        {
+          resourceType: "vmware-resource",
+          componentType: DashboardComponentType.VMwareHostList,
+          service: VMwareResourceService,
+          included: "cpuCapacityMhz",
+          excluded: "isPoweredOn",
+        },
         {
           resourceType: "docker-swarm-resource",
           componentType: DashboardComponentType.DockerSwarmServiceList,

package/Tests/Server/API/EnterpriseLicenseReportUserCount.test.ts

@@ -1503,6 +1503,17 @@ describe("EnterpriseLicenseAPI POST /enterprise-license/validate", () => {
           return [];
         },
       );
+    /*
+     * Relative to now, like every other date in this file: the legacy usage
+     * fallback only trusts userCountUpdatedAt while it is inside the
+     * InstanceUsageFreshnessInDays window, so a fixed date silently stops
+     * being fresh and the echoed count collapses to 0.
+     */
+    const userCountUpdatedAt: Date = OneUptimeDate.addRemoveDays(
+      OneUptimeDate.getCurrentDate(),
+      -1,
+    );
+
     EnterpriseLicenseService.findOneById = jest
       .fn()
       .mockImplementation(async (): Promise<EnterpriseLicense> => {
@@ -1510,7 +1521,7 @@ describe("EnterpriseLicenseAPI POST /enterprise-license/validate", () => {
         events.push("license");
         return makeLicense({
           currentUserCount: 17,
-          userCountUpdatedAt: new Date("2026-09-01T12:00:00.000Z"),
+          userCountUpdatedAt,
         });
       });
 
@@ -1523,7 +1534,7 @@ describe("EnterpriseLicenseAPI POST /enterprise-license/validate", () => {
     expect(getResponseBody()).toEqual(
       expect.objectContaining({
         currentUserCount: 17,
-        userCountUpdatedAt: "2026-09-01T12:00:00.000Z",
+        userCountUpdatedAt: userCountUpdatedAt.toISOString(),
       }),
     );
     expect(