@oneuptime/common 13.0.1 → 13.0.3

package/Tests/Utils/Rum/SessionIdentity.test.ts

@@ -269,4 +269,76 @@ describe("SessionIdentity", () => {
       }
     });
   });
+
+  describe("isVisitorId", () => {
+    /*
+     * Shared by the recorder (which only stores what passes) and the ingest
+     * parser (which drops what does not). Strict on purpose: the id is
+     * random and ours, so there is no legitimate "almost" shape to be
+     * lenient towards, and leniency here is what would let a hand-crafted
+     * POST file a recording under an arbitrary string.
+     */
+    const VALID: string = "3f1a9c7e5b2d4801f6a3c9e7b1d5028f";
+
+    it("accepts exactly 32 lowercase hex characters", () => {
+      expect(SessionIdentity.isVisitorId(VALID)).toBe(true);
+      expect(SessionIdentity.isVisitorId("0".repeat(32))).toBe(true);
+      expect(SessionIdentity.isVisitorId("f".repeat(32))).toBe(true);
+    });
+
+    it("rejects uppercase hex, which the recorder never mints", () => {
+      expect(SessionIdentity.isVisitorId(VALID.toUpperCase())).toBe(false);
+      expect(SessionIdentity.isVisitorId(`${VALID.slice(0, 31)}F`)).toBe(false);
+    });
+
+    it("rejects 31 and 33 characters", () => {
+      expect(VALID.slice(0, 31)).toHaveLength(31);
+      expect(SessionIdentity.isVisitorId(VALID.slice(0, 31))).toBe(false);
+      expect(`${VALID}0`).toHaveLength(33);
+      expect(SessionIdentity.isVisitorId(`${VALID}0`)).toBe(false);
+      expect(SessionIdentity.isVisitorId("")).toBe(false);
+    });
+
+    it("rejects non-hex characters and surrounding whitespace", () => {
+      expect(SessionIdentity.isVisitorId(`${VALID.slice(0, 31)}g`)).toBe(false);
+      expect(SessionIdentity.isVisitorId(`${VALID.slice(0, 31)}-`)).toBe(false);
+      expect(SessionIdentity.isVisitorId(` ${VALID}`)).toBe(false);
+      expect(SessionIdentity.isVisitorId(`${VALID} `)).toBe(false);
+      /* `$` must not be lenient about a trailing newline. */
+      expect(SessionIdentity.isVisitorId(`${VALID}\n`)).toBe(false);
+    });
+
+    it("rejects anything that is not a string", () => {
+      const notStrings: Array<unknown> = [
+        undefined,
+        null,
+        42,
+        0,
+        true,
+        false,
+        {},
+        { id: VALID },
+        [],
+        [VALID],
+        new String(VALID),
+      ];
+
+      for (const value of notStrings) {
+        expect(SessionIdentity.isVisitorId(value)).toBe(false);
+      }
+    });
+
+    it("narrows an unknown to string on success", () => {
+      const value: unknown = VALID;
+
+      if (!SessionIdentity.isVisitorId(value)) {
+        throw new Error("expected the fixture to pass");
+      }
+
+      /* Compiles only because the guard narrowed `value` to string. */
+      const narrowed: string = value;
+
+      expect(narrowed).toBe(VALID);
+    });
+  });
 });

package/Tests/Utils/Slo/SloBurnRateRuleState.test.ts

@@ -1,71 +1,379 @@
 import SloStatus from "../../../Types/ServiceLevelObjective/SloStatus";
 import {
-  canSloFireBurnRateAlerts,
+  canSloFireBurnRateRules,
+  isBurnRateRuleAlertFiring,
   isBurnRateRuleFiring,
+  isBurnRateRuleIncidentFiring,
+  SloBurnRateRuleState,
 } from "../../../Utils/Slo/SloBurnRateRuleState";
 
+/** The instant the worker stamped the fire. Every other timestamp is relative to it. */
 const FIRED_AT: Date = new Date("2026-07-25T10:00:00.000Z");
 
+/** The resolve that closed the fire above. */
+const RESOLVED_AFTER_FIRE: Date = new Date("2026-07-25T10:30:00.000Z");
+
+/** A resolve left over from the PREVIOUS lifecycle, which the fire above re-opened. */
+const RESOLVED_BEFORE_FIRE: Date = new Date("2026-07-25T09:00:00.000Z");
+
 describe("SloBurnRateRuleState", () => {
-  describe("isBurnRateRuleFiring", () => {
+  describe("isBurnRateRuleAlertFiring", () => {
     it("is false for a rule that has never fired", () => {
-      expect(isBurnRateRuleFiring({})).toBe(false);
+      expect(isBurnRateRuleAlertFiring({})).toBe(false);
+    });
+
+    it("is false for every empty spelling of the alert columns", () => {
+      /*
+       * A column the worker has never written comes back null, while a column
+       * the caller did not select comes back undefined. The table sees both
+       * spellings and neither one is a fire.
+       */
+      expect(
+        isBurnRateRuleAlertFiring({
+          lastAlertCreatedAt: null,
+          lastAlertResolvedAt: null,
+        }),
+      ).toBe(false);
+      expect(
+        isBurnRateRuleAlertFiring({
+          lastAlertCreatedAt: undefined,
+          lastAlertResolvedAt: undefined,
+        }),
+      ).toBe(false);
       expect(
-        isBurnRateRuleFiring({
+        isBurnRateRuleAlertFiring({
           lastAlertCreatedAt: null,
+          lastAlertResolvedAt: undefined,
+        }),
+      ).toBe(false);
+      expect(
+        isBurnRateRuleAlertFiring({
+          lastAlertCreatedAt: undefined,
           lastAlertResolvedAt: null,
         }),
       ).toBe(false);
     });
 
     it("is true when a fire has never been resolved", () => {
-      expect(isBurnRateRuleFiring({ lastAlertCreatedAt: FIRED_AT })).toBe(true);
+      /*
+       * The open state the "Firing" pill exists to show, in all three spellings
+       * of "no resolve yet".
+       */
+      expect(isBurnRateRuleAlertFiring({ lastAlertCreatedAt: FIRED_AT })).toBe(
+        true,
+      );
+      expect(
+        isBurnRateRuleAlertFiring({
+          lastAlertCreatedAt: FIRED_AT,
+          lastAlertResolvedAt: null,
+        }),
+      ).toBe(true);
+      expect(
+        isBurnRateRuleAlertFiring({
+          lastAlertCreatedAt: FIRED_AT,
+          lastAlertResolvedAt: undefined,
+        }),
+      ).toBe(true);
+    });
+
+    it("is true when the rule re-fired after an older resolve", () => {
+      /*
+       * The columns are overwritten in place rather than appended to, so a
+       * stale resolve from the previous lifecycle sits beside the live fire.
+       */
+      expect(
+        isBurnRateRuleAlertFiring({
+          lastAlertCreatedAt: FIRED_AT,
+          lastAlertResolvedAt: RESOLVED_BEFORE_FIRE,
+        }),
+      ).toBe(true);
     });
 
     it("is false when the resolve is newer than the fire", () => {
       expect(
-        isBurnRateRuleFiring({
+        isBurnRateRuleAlertFiring({
           lastAlertCreatedAt: FIRED_AT,
-          lastAlertResolvedAt: new Date("2026-07-25T10:30:00.000Z"),
+          lastAlertResolvedAt: RESOLVED_AFTER_FIRE,
         }),
       ).toBe(false);
     });
 
-    it("is true when the rule re-fired after an older resolve", () => {
+    it("treats an equal-timestamp pair as resolved, not firing", () => {
+      /*
+       * The worker always writes the resolve strictly after the fire, so an
+       * equal pair can only be one lifecycle that opened and closed inside the
+       * same millisecond. Leaving a red "Firing" pill on a rule with nothing
+       * open would be the worse error, so the tie breaks towards resolved.
+       */
       expect(
-        isBurnRateRuleFiring({
+        isBurnRateRuleAlertFiring({
           lastAlertCreatedAt: FIRED_AT,
-          lastAlertResolvedAt: new Date("2026-07-25T09:00:00.000Z"),
+          lastAlertResolvedAt: new Date(FIRED_AT.getTime()),
+        }),
+      ).toBe(false);
+    });
+
+    it("is false when only a resolve is recorded", () => {
+      /*
+       * Defensive: a resolve with no fire is not a firing state, however the
+       * missing fire is spelled.
+       */
+      expect(isBurnRateRuleAlertFiring({ lastAlertResolvedAt: FIRED_AT })).toBe(
+        false,
+      );
+      expect(
+        isBurnRateRuleAlertFiring({
+          lastAlertCreatedAt: null,
+          lastAlertResolvedAt: FIRED_AT,
+        }),
+      ).toBe(false);
+    });
+
+    it("ignores the incident columns entirely", () => {
+      /*
+       * Guards the twin predicates against being wired to each other's
+       * columns: an open incident on a rule that never raised an alert must
+       * not make the alert side read as firing.
+       */
+      const incidentOnly: SloBurnRateRuleState = {
+        lastIncidentCreatedAt: FIRED_AT,
+      };
+
+      expect(isBurnRateRuleAlertFiring(incidentOnly)).toBe(false);
+    });
+  });
+
+  describe("isBurnRateRuleIncidentFiring", () => {
+    it("is false for a rule that has never declared an incident", () => {
+      expect(isBurnRateRuleIncidentFiring({})).toBe(false);
+    });
+
+    it("is false for every empty spelling of the incident columns", () => {
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: null,
+          lastIncidentResolvedAt: null,
+        }),
+      ).toBe(false);
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: undefined,
+          lastIncidentResolvedAt: undefined,
+        }),
+      ).toBe(false);
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: null,
+          lastIncidentResolvedAt: undefined,
+        }),
+      ).toBe(false);
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: undefined,
+          lastIncidentResolvedAt: null,
+        }),
+      ).toBe(false);
+    });
+
+    it("is true when a declared incident has never been resolved", () => {
+      expect(
+        isBurnRateRuleIncidentFiring({ lastIncidentCreatedAt: FIRED_AT }),
+      ).toBe(true);
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: FIRED_AT,
+          lastIncidentResolvedAt: null,
         }),
       ).toBe(true);
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: FIRED_AT,
+          lastIncidentResolvedAt: undefined,
+        }),
+      ).toBe(true);
+    });
+
+    it("is true when the rule re-declared after an older resolve", () => {
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: FIRED_AT,
+          lastIncidentResolvedAt: RESOLVED_BEFORE_FIRE,
+        }),
+      ).toBe(true);
+    });
+
+    it("is false when the resolve is newer than the declaration", () => {
+      /*
+       * This is also the responder-resolved-by-hand case: the worker stamps
+       * the resolve it observed and must not re-declare while the burn goes on.
+       */
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: FIRED_AT,
+          lastIncidentResolvedAt: RESOLVED_AFTER_FIRE,
+        }),
+      ).toBe(false);
     });
 
     it("treats an equal-timestamp pair as resolved, not firing", () => {
       /*
-       * The worker always writes the resolve strictly after the fire, so
-       * an equal pair can only be one lifecycle — leaving a red "Firing"
-       * pill on a rule with nothing open would be the worse error.
+       * Same tie-break as the alert side, and pinned separately because the
+       * two predicates are free to drift apart: the worker writes the resolve
+       * strictly after the declaration, so an equal pair is one closed
+       * lifecycle rather than a live incident.
        */
       expect(
-        isBurnRateRuleFiring({
-          lastAlertCreatedAt: FIRED_AT,
-          lastAlertResolvedAt: new Date(FIRED_AT.getTime()),
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: FIRED_AT,
+          lastIncidentResolvedAt: new Date(FIRED_AT.getTime()),
         }),
       ).toBe(false);
     });
 
     it("is false when only a resolve is recorded", () => {
-      // Defensive: a resolve with no fire is not a firing state.
-      expect(isBurnRateRuleFiring({ lastAlertResolvedAt: FIRED_AT })).toBe(
+      expect(
+        isBurnRateRuleIncidentFiring({ lastIncidentResolvedAt: FIRED_AT }),
+      ).toBe(false);
+      expect(
+        isBurnRateRuleIncidentFiring({
+          lastIncidentCreatedAt: null,
+          lastIncidentResolvedAt: FIRED_AT,
+        }),
+      ).toBe(false);
+    });
+
+    it("ignores the alert columns entirely", () => {
+      /*
+       * The realistic bug when writing this twin is copying the alert
+       * predicate and forgetting to rename the columns. A rule that is paging
+       * on an alert but declared no incident is exactly the row that would
+       * then wrongly show an incident as open — and the worker would skip
+       * declaring the incident it owes.
+       */
+      const alertOnly: SloBurnRateRuleState = {
+        lastAlertCreatedAt: FIRED_AT,
+      };
+
+      expect(isBurnRateRuleIncidentFiring(alertOnly)).toBe(false);
+    });
+  });
+
+  describe("isBurnRateRuleFiring", () => {
+    it("is false when neither output has ever opened", () => {
+      expect(isBurnRateRuleFiring({})).toBe(false);
+
+      const neverFired: SloBurnRateRuleState = {
+        lastAlertCreatedAt: null,
+        lastAlertResolvedAt: null,
+        lastIncidentCreatedAt: null,
+        lastIncidentResolvedAt: null,
+      };
+
+      expect(isBurnRateRuleFiring(neverFired)).toBe(false);
+    });
+
+    it("is true when only the alert is open", () => {
+      /*
+       * An alert-only rule is the model default (shouldCreateIncident false),
+       * so this is the common shape of a firing row.
+       */
+      const alertOnly: SloBurnRateRuleState = {
+        lastAlertCreatedAt: FIRED_AT,
+      };
+
+      expect(isBurnRateRuleFiring(alertOnly)).toBe(true);
+    });
+
+    it("is true when only the incident is open", () => {
+      /*
+       * An incident-only rule (shouldCreateAlert false) must light the same
+       * pill; the reader cares that something is open, not which table it is in.
+       */
+      const incidentOnly: SloBurnRateRuleState = {
+        lastIncidentCreatedAt: FIRED_AT,
+      };
+
+      expect(isBurnRateRuleFiring(incidentOnly)).toBe(true);
+    });
+
+    it("is true when both outputs are open", () => {
+      const both: SloBurnRateRuleState = {
+        lastAlertCreatedAt: FIRED_AT,
+        lastIncidentCreatedAt: FIRED_AT,
+      };
+
+      expect(isBurnRateRuleFiring(both)).toBe(true);
+    });
+
+    it("is true when the alert is still open after the incident was resolved", () => {
+      /*
+       * The two lifecycles close independently — a responder can resolve the
+       * incident while the alert keeps paging — so the OR must not be narrowed
+       * to an AND.
+       */
+      const alertOpenIncidentClosed: SloBurnRateRuleState = {
+        lastAlertCreatedAt: FIRED_AT,
+        lastIncidentCreatedAt: FIRED_AT,
+        lastIncidentResolvedAt: RESOLVED_AFTER_FIRE,
+      };
+
+      expect(isBurnRateRuleFiring(alertOpenIncidentClosed)).toBe(true);
+      expect(isBurnRateRuleAlertFiring(alertOpenIncidentClosed)).toBe(true);
+      expect(isBurnRateRuleIncidentFiring(alertOpenIncidentClosed)).toBe(false);
+    });
+
+    it("is true when the incident is still open after the alert was resolved", () => {
+      const incidentOpenAlertClosed: SloBurnRateRuleState = {
+        lastAlertCreatedAt: FIRED_AT,
+        lastAlertResolvedAt: RESOLVED_AFTER_FIRE,
+        lastIncidentCreatedAt: FIRED_AT,
+      };
+
+      expect(isBurnRateRuleFiring(incidentOpenAlertClosed)).toBe(true);
+      expect(isBurnRateRuleAlertFiring(incidentOpenAlertClosed)).toBe(false);
+      expect(isBurnRateRuleIncidentFiring(incidentOpenAlertClosed)).toBe(true);
+    });
+
+    it("is false once both outputs have been resolved", () => {
+      const bothClosed: SloBurnRateRuleState = {
+        lastAlertCreatedAt: FIRED_AT,
+        lastAlertResolvedAt: RESOLVED_AFTER_FIRE,
+        lastIncidentCreatedAt: FIRED_AT,
+        lastIncidentResolvedAt: RESOLVED_AFTER_FIRE,
+      };
+
+      expect(isBurnRateRuleFiring(bothClosed)).toBe(false);
+    });
+
+    it("does not let one output's column pair bleed into the other", () => {
+      /*
+       * The cross-contamination guard. This row has a live alert and a resolve
+       * stamped on the incident side that no declaration ever matched — the
+       * shape left behind when a rule flips shouldCreateIncident off and the
+       * service resolves the orphaned incident. If either predicate read the
+       * wrong column, the incident side would report open off the alert's
+       * create (or closed off the incident's resolve) and the worker would
+       * refuse to declare when the rule is turned back on.
+       */
+      const alertOpenIncidentNeverDeclared: SloBurnRateRuleState = {
+        lastAlertCreatedAt: FIRED_AT,
+        lastIncidentResolvedAt: RESOLVED_AFTER_FIRE,
+      };
+
+      expect(isBurnRateRuleIncidentFiring(alertOpenIncidentNeverDeclared)).toBe(
         false,
       );
+      expect(isBurnRateRuleAlertFiring(alertOpenIncidentNeverDeclared)).toBe(
+        true,
+      );
+      expect(isBurnRateRuleFiring(alertOpenIncidentNeverDeclared)).toBe(true);
     });
   });
 
-  describe("canSloFireBurnRateAlerts", () => {
+  describe("canSloFireBurnRateRules", () => {
     it("is true for a healthy, enabled SLO", () => {
       expect(
-        canSloFireBurnRateAlerts({
+        canSloFireBurnRateRules({
           isEnabled: true,
           sloStatus: SloStatus.Healthy,
         }),
@@ -74,13 +382,13 @@ describe("SloBurnRateRuleState", () => {
 
     it("is true while the budget is at risk or exhausted — that is when rules fire", () => {
       expect(
-        canSloFireBurnRateAlerts({
+        canSloFireBurnRateRules({
           isEnabled: true,
           sloStatus: SloStatus.AtRisk,
         }),
       ).toBe(true);
       expect(
-        canSloFireBurnRateAlerts({
+        canSloFireBurnRateRules({
           isEnabled: true,
           sloStatus: SloStatus.BudgetExhausted,
         }),
@@ -89,12 +397,12 @@ describe("SloBurnRateRuleState", () => {
 
     it("is false for a disabled SLO", () => {
       /*
-       * Disabling resolves every open alert without stamping the rule's
-       * lastAlertResolvedAt, so the rule columns alone would still read as
+       * Disabling resolves every open alert and incident without stamping the
+       * rule's resolve columns, so the rule columns alone would still read as
        * firing.
        */
       expect(
-        canSloFireBurnRateAlerts({
+        canSloFireBurnRateRules({
           isEnabled: false,
           sloStatus: SloStatus.AtRisk,
         }),
@@ -103,13 +411,13 @@ describe("SloBurnRateRuleState", () => {
 
     it("is false for the two guard statuses that resolve without stamping", () => {
       expect(
-        canSloFireBurnRateAlerts({
+        canSloFireBurnRateRules({
           isEnabled: true,
           sloStatus: SloStatus.Misconfigured,
         }),
       ).toBe(false);
       expect(
-        canSloFireBurnRateAlerts({
+        canSloFireBurnRateRules({
           isEnabled: true,
           sloStatus: SloStatus.Paused,
         }),
@@ -118,7 +426,45 @@ describe("SloBurnRateRuleState", () => {
 
     it("stays optimistic when the fields were not loaded", () => {
       // Never hide a genuinely firing rule because a fetch has not landed.
-      expect(canSloFireBurnRateAlerts({})).toBe(true);
+      expect(canSloFireBurnRateRules({})).toBe(true);
+      expect(canSloFireBurnRateRules({ isEnabled: true })).toBe(true);
+      expect(canSloFireBurnRateRules({ sloStatus: SloStatus.Healthy })).toBe(
+        true,
+      );
+    });
+
+    it("treats a null isEnabled as unknown rather than disabled", () => {
+      /*
+       * Only an explicit false suppresses the badge. A null arrives from a
+       * column that was selected but never written, and reading it as disabled
+       * would silently blank the pill on every such SLO.
+       */
+      expect(
+        canSloFireBurnRateRules({
+          isEnabled: null,
+          sloStatus: SloStatus.AtRisk,
+        }),
+      ).toBe(true);
+      expect(
+        canSloFireBurnRateRules({
+          isEnabled: undefined,
+          sloStatus: null,
+        }),
+      ).toBe(true);
+    });
+
+    it("suppresses a disabled SLO whatever its last status was", () => {
+      /*
+       * isEnabled is checked before the status, so a stale Healthy status
+       * cannot resurrect the badge on a disabled SLO.
+       */
+      expect(
+        canSloFireBurnRateRules({
+          isEnabled: false,
+          sloStatus: SloStatus.Healthy,
+        }),
+      ).toBe(false);
+      expect(canSloFireBurnRateRules({ isEnabled: false })).toBe(false);
     });
   });
 });

package/Tests/Utils/Telemetry/OriginAllowList.test.ts

@@ -631,3 +631,121 @@ describe("OriginAllowList validator and matcher agree", () => {
     });
   }
 });
+
+/*
+ * The form-field half of the allowlist rules, shared by the ingestion key
+ * creation wizard and the key's detail page. Before it existed only the
+ * wizard checked anything, so the detail page accepted every well-formed
+ * JSON document and let the API do the refusing, one round trip later, in
+ * the server's words.
+ */
+describe("OriginAllowList.validateAllowedOriginsFormValue", () => {
+  type Validate = (value: unknown, allowEmptyList?: boolean) => string | null;
+
+  const validate: Validate = (
+    value: unknown,
+    allowEmptyList: boolean = false,
+  ): string | null => {
+    return OriginAllowList.validateAllowedOriginsFormValue({
+      value: value,
+      allowEmptyList: allowEmptyList,
+    });
+  };
+
+  test("accepts the JSON text the editor holds", () => {
+    expect(
+      validate('["https://app.example.com", "https://*.example.org"]'),
+    ).toBeNull();
+  });
+
+  /*
+   * The detail page loads the stored value, so the already-parsed array
+   * reaches the validator whenever the field is not touched. Refusing it
+   * would block every other edit on the page.
+   */
+  test("accepts the already-parsed array the fetch loaded", () => {
+    expect(validate(["https://app.example.com"])).toBeNull();
+  });
+
+  test.each([undefined, null])(
+    "says nothing about %p, which is the required check's business",
+    (value: unknown) => {
+      expect(validate(value)).toBeNull();
+    },
+  );
+
+  test.each([
+    ['["https://app.example.com"', "an unbalanced array"],
+    ["{{origins}}", "a handlebars template"],
+    ["   ", "whitespace"],
+    ["", "the empty string"],
+  ])("refuses %j (%s) as invalid JSON", (value: string) => {
+    expect(validate(value)).toMatch(/^Allowed Origins is not valid JSON\./);
+  });
+
+  test.each(['{"origin":"https://app.example.com"}', '"https://x.com"', "17"])(
+    "refuses %j, which is JSON but not a list",
+    (value: string) => {
+      expect(validate(value)).toBe(
+        "Enter at least one allowed origin as a JSON array.",
+      );
+    },
+  );
+
+  test("refuses an entry that is not text", () => {
+    expect(validate('["https://app.example.com", 17]')).toBe(
+      "Every allowed origin must be text.",
+    );
+  });
+
+  /*
+   * A path is the dangerous one: `matches` compares origins, so
+   * "https://app.example.com/admin" would match every request from
+   * app.example.com - looser than what was written, and read as tighter.
+   */
+  test("refuses an origin carrying a path", () => {
+    expect(validate('["https://app.example.com/admin"]')).toMatch(
+      /must not contain a path/,
+    );
+  });
+
+  test("refuses the evilexample.com wildcard trap", () => {
+    expect(validate('["https://*example.com"]')).not.toBeNull();
+  });
+
+  test("reports the first bad origin, not the last", () => {
+    expect(
+      validate('["https://app.example.com/admin", "ftp://x.example"]'),
+    ).toMatch(/must not contain a path/);
+  });
+
+  /*
+   * The one rule that differs between the two callers. A new browser key
+   * with no origins is refused on every request from the moment it exists,
+   * so the wizard will not create one; the detail page has to allow an empty
+   * list because that is how a server key's leftovers are dropped, and it
+   * cannot tell the key types apart - the service, which can, still refuses
+   * to empty a browser key's list.
+   */
+  test.each(["[]", '["   "]'])(
+    "refuses %j while creating, where an empty list has no use",
+    (value: string) => {
+      expect(validate(value, false)).toBe(
+        "Enter at least one allowed origin as a JSON array.",
+      );
+    },
+  );
+
+  test.each(["[]", '["   "]'])(
+    "allows %j while editing, where an empty list clears the allowlist",
+    (value: string) => {
+      expect(validate(value, true)).toBeNull();
+    },
+  );
+
+  test("still checks the origins it does have when an empty list is allowed", () => {
+    expect(validate('["https://app.example.com/admin"]', true)).toMatch(
+      /must not contain a path/,
+    );
+  });
+});