@oneuptime/common 13.0.1 → 13.0.4

package/Tests/Server/Utils/Billing/BillingFailureNoticeThrottle.test.ts

@@ -0,0 +1,359 @@
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+import ObjectID from "../../../../Types/ObjectID";
+import OneUptimeDate from "../../../../Types/Date";
+
+/*
+ * The throttle is the only thing standing between a declined card and one
+ * email per paging attempt, arriving during the outage the pages were
+ * about - and, in the other direction, between a Redis blip and silently
+ * never telling anyone that OneUptime can no longer page them at all.
+ *
+ * So the behaviour worth pinning is not "it calls Redis": it is which
+ * notices collapse into one another (same project, same kind, same day),
+ * which do not, that the window EXPIRES rather than latching, and that an
+ * unreachable cache sends rather than suppresses.
+ *
+ * GlobalCache is mocked as a real in-memory SET NX with TTL so the
+ * concurrency and expiry cases are exercised for real rather than asserted
+ * through the mock's call log.
+ */
+
+interface StoredEntry {
+  value: string;
+  expiresAtMs: number;
+}
+
+interface SetIfNotExistsCall {
+  namespace: string;
+  key: string;
+  value: string;
+  expiresInSeconds: number | undefined;
+}
+
+const store: Map<string, StoredEntry> = new Map<string, StoredEntry>();
+const setCalls: Array<SetIfNotExistsCall> = [];
+const warnings: Array<string> = [];
+let nowMs: number = 1_800_000_000_000;
+let cacheError: Error | null = null;
+
+async function fakeSetStringIfNotExists(
+  namespace: string,
+  key: string,
+  value: string,
+  options?: { expiresInSeconds?: number },
+): Promise<boolean> {
+  setCalls.push({
+    namespace: namespace,
+    key: key,
+    value: value,
+    expiresInSeconds: options?.expiresInSeconds,
+  });
+
+  if (cacheError) {
+    throw cacheError;
+  }
+
+  const fullKey: string = `${namespace}-${key}`;
+  const existing: StoredEntry | undefined = store.get(fullKey);
+
+  if (existing && existing.expiresAtMs > nowMs) {
+    return false;
+  }
+
+  store.set(fullKey, {
+    value: value,
+    expiresAtMs: nowMs + (options?.expiresInSeconds ?? 0) * 1000,
+  });
+
+  return true;
+}
+
+jest.mock("../../../../Server/Infrastructure/GlobalCache", () => {
+  return {
+    __esModule: true,
+    default: {
+      setStringIfNotExists: (
+        namespace: string,
+        key: string,
+        value: string,
+        options?: { expiresInSeconds?: number },
+      ): Promise<boolean> => {
+        return fakeSetStringIfNotExists(namespace, key, value, options);
+      },
+    },
+  };
+});
+
+jest.mock("../../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      warn: (message: unknown): void => {
+        warnings.push(String(message));
+      },
+      error: (): void => {
+        // Not asserted on.
+      },
+      info: (): void => {
+        // Not asserted on.
+      },
+      debug: (): void => {
+        // Not asserted on.
+      },
+    },
+  };
+});
+
+import {
+  BillingFailureNoticeKind,
+  shouldSendBillingFailureNotice,
+} from "../../../../Server/Utils/Billing/BillingFailureNoticeThrottle";
+
+describe("shouldSendBillingFailureNotice", () => {
+  beforeEach(() => {
+    store.clear();
+    setCalls.length = 0;
+    warnings.length = 0;
+    cacheError = null;
+    nowMs = 1_800_000_000_000;
+  });
+
+  test("sends the first notice of the day", async () => {
+    await expect(
+      shouldSendBillingFailureNotice({
+        projectId: new ObjectID("11111111-1111-1111-1111-111111111111"),
+        kind: BillingFailureNoticeKind.SmsAndCallRechargeFailed,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  /*
+   * The storm case: several paging attempts fail within seconds of each
+   * other. Exactly one of them may mail the owners.
+   */
+  test("suppresses every later notice for the same project and kind", async () => {
+    const projectId: ObjectID = new ObjectID(
+      "11111111-1111-1111-1111-111111111111",
+    );
+
+    const results: Array<boolean> = [];
+
+    for (let attempt: number = 0; attempt < 25; attempt++) {
+      results.push(
+        await shouldSendBillingFailureNotice({
+          projectId: projectId,
+          kind: BillingFailureNoticeKind.SmsAndCallRechargeFailed,
+        }),
+      );
+    }
+
+    expect(results.filter(Boolean)).toHaveLength(1);
+    expect(results[0]).toBe(true);
+  });
+
+  /*
+   * Attempts do not arrive one at a time. A check-then-act would let every
+   * concurrent caller read "no key" and all decide they were first, which
+   * is the exact mail bomb this exists to prevent.
+   */
+  test("only one of many concurrent callers claims the window", async () => {
+    const projectId: ObjectID = new ObjectID(
+      "22222222-2222-2222-2222-222222222222",
+    );
+
+    const results: Array<boolean> = await Promise.all(
+      Array.from({ length: 50 }, (): Promise<boolean> => {
+        return shouldSendBillingFailureNotice({
+          projectId: projectId,
+          kind: BillingFailureNoticeKind.AiCreditRechargeFailed,
+        });
+      }),
+    );
+
+    expect(results.filter(Boolean)).toHaveLength(1);
+  });
+
+  test("keeps one project's notice from silencing another's", async () => {
+    const kind: BillingFailureNoticeKind =
+      BillingFailureNoticeKind.SmsAndCallRechargeFailed;
+
+    await expect(
+      shouldSendBillingFailureNotice({
+        projectId: new ObjectID("33333333-3333-3333-3333-333333333333"),
+        kind: kind,
+      }),
+    ).resolves.toBe(true);
+
+    await expect(
+      shouldSendBillingFailureNotice({
+        projectId: new ObjectID("44444444-4444-4444-4444-444444444444"),
+        kind: kind,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  /*
+   * "We cannot page for you" and "we cannot run AI for you" are different
+   * problems with different fixes. One must not stand in for the other.
+   */
+  test("throttles each kind of failure separately", async () => {
+    const projectId: ObjectID = new ObjectID(
+      "55555555-5555-5555-5555-555555555555",
+    );
+
+    await expect(
+      shouldSendBillingFailureNotice({
+        projectId: projectId,
+        kind: BillingFailureNoticeKind.SmsAndCallRechargeFailed,
+      }),
+    ).resolves.toBe(true);
+
+    await expect(
+      shouldSendBillingFailureNotice({
+        projectId: projectId,
+        kind: BillingFailureNoticeKind.AiCreditRechargeFailed,
+      }),
+    ).resolves.toBe(true);
+
+    await expect(
+      shouldSendBillingFailureNotice({
+        projectId: projectId,
+        kind: BillingFailureNoticeKind.SmsAndCallRechargeFailed,
+      }),
+    ).resolves.toBe(false);
+  });
+
+  /*
+   * This is the whole point of a window rather than a latch. A project
+   * whose recharge can never succeed - no card, or a card that keeps
+   * declining - would otherwise be told once and then never again.
+   */
+  test("is a window that reopens, not a latch that never clears", async () => {
+    const projectId: ObjectID = new ObjectID(
+      "66666666-6666-6666-6666-666666666666",
+    );
+    const kind: BillingFailureNoticeKind =
+      BillingFailureNoticeKind.SmsAndCallRechargeFailed;
+
+    await expect(
+      shouldSendBillingFailureNotice({ projectId, kind }),
+    ).resolves.toBe(true);
+
+    // Still inside the day.
+    nowMs += OneUptimeDate.getSecondsInDays(1) * 1000 - 1000;
+    await expect(
+      shouldSendBillingFailureNotice({ projectId, kind }),
+    ).resolves.toBe(false);
+
+    // Past it.
+    nowMs += 2000;
+    await expect(
+      shouldSendBillingFailureNotice({ projectId, kind }),
+    ).resolves.toBe(true);
+  });
+
+  test("claims the window for exactly one day", async () => {
+    await shouldSendBillingFailureNotice({
+      projectId: new ObjectID("77777777-7777-7777-7777-777777777777"),
+      kind: BillingFailureNoticeKind.AiCreditRechargeFailed,
+    });
+
+    expect(setCalls).toHaveLength(1);
+    expect(setCalls[0]?.namespace).toBe("billing-failure-notice");
+    expect(setCalls[0]?.key).toContain("77777777-7777-7777-7777-777777777777");
+    expect(setCalls[0]?.expiresInSeconds).toBe(
+      OneUptimeDate.getSecondsInDays(1),
+    );
+  });
+
+  test("scopes the key by project and kind", async () => {
+    await shouldSendBillingFailureNotice({
+      projectId: new ObjectID("88888888-8888-8888-8888-888888888888"),
+      kind: BillingFailureNoticeKind.AiCreditRechargeFailed,
+    });
+
+    expect(setCalls[0]?.key).toBe(
+      "88888888-8888-8888-8888-888888888888-ai-credit-recharge-failed",
+    );
+  });
+
+  /*
+   * Fails OPEN. A suppressed "we cannot page anyone for you" is worse than
+   * a duplicated one, so an unreachable cache must not become silence.
+   */
+  test("sends when the shared cache is unreachable", async () => {
+    cacheError = new Error("Cache is not connected");
+
+    await expect(
+      shouldSendBillingFailureNotice({
+        projectId: new ObjectID("99999999-9999-9999-9999-999999999999"),
+        kind: BillingFailureNoticeKind.SmsAndCallRechargeFailed,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  test("keeps sending on every attempt while the cache stays down", async () => {
+    cacheError = new Error("Cache is not connected");
+    const projectId: ObjectID = new ObjectID(
+      "99999999-9999-9999-9999-999999999999",
+    );
+
+    for (let attempt: number = 0; attempt < 3; attempt++) {
+      await expect(
+        shouldSendBillingFailureNotice({
+          projectId: projectId,
+          kind: BillingFailureNoticeKind.SmsAndCallRechargeFailed,
+        }),
+      ).resolves.toBe(true);
+    }
+  });
+
+  test("says in the log that the window is not being enforced", async () => {
+    cacheError = new Error("Cache is not connected");
+
+    await shouldSendBillingFailureNotice({
+      projectId: new ObjectID("99999999-9999-9999-9999-999999999999"),
+      kind: BillingFailureNoticeKind.SmsAndCallRechargeFailed,
+    });
+
+    expect(warnings[0]).toContain("99999999-9999-9999-9999-999999999999");
+    expect(warnings[0]).toContain("sms-and-call-recharge-failed");
+    expect(warnings[0]).toContain("not enforced");
+  });
+
+  test("resumes throttling once the cache comes back", async () => {
+    const projectId: ObjectID = new ObjectID(
+      "12121212-1212-1212-1212-121212121212",
+    );
+    const kind: BillingFailureNoticeKind =
+      BillingFailureNoticeKind.SmsAndCallRechargeFailed;
+
+    cacheError = new Error("Cache is not connected");
+    await expect(
+      shouldSendBillingFailureNotice({ projectId, kind }),
+    ).resolves.toBe(true);
+
+    cacheError = null;
+    await expect(
+      shouldSendBillingFailureNotice({ projectId, kind }),
+    ).resolves.toBe(true);
+    await expect(
+      shouldSendBillingFailureNotice({ projectId, kind }),
+    ).resolves.toBe(false);
+  });
+});
+
+describe("BillingFailureNoticeKind", () => {
+  /*
+   * These values are baked into live Redis keys. Renaming one reopens
+   * every window it was throttling, mid-incident.
+   */
+  test("keeps its persisted values", () => {
+    expect(BillingFailureNoticeKind.SmsAndCallRechargeFailed).toBe(
+      "sms-and-call-recharge-failed",
+    );
+    expect(BillingFailureNoticeKind.AiCreditRechargeFailed).toBe(
+      "ai-credit-recharge-failed",
+    );
+  });
+});

package/Tests/Server/Utils/CodeRepository/GitHub/GitHubWebhookEvents.test.ts

@@ -0,0 +1,318 @@
+import { describe, expect, test } from "@jest/globals";
+import { JSONObject } from "../../../../../Types/JSON";
+import GitHubWebhookEvents, {
+  DEFAULT_GITHUB_TRIGGER_LABEL,
+  GitHubWebhookEvent,
+  GitHubWebhookRepository,
+  GitHubWebhookSender,
+} from "../../../../../Server/Utils/CodeRepository/GitHub/GitHubWebhookEvents";
+
+/*
+ * These readers are the boundary where a raw, attacker-influenced webhook
+ * body becomes typed values the interactive GitHub app acts on - it opens
+ * pull requests against whatever repository they name - so what matters is
+ * as much what they REFUSE as what they extract. Every case below is a
+ * payload shape GitHub can send or an attacker can forge, not a synthetic
+ * type exercise.
+ */
+
+describe("GitHubWebhookEvents.getRepository", () => {
+  test("splits owner/repo on the first slash", () => {
+    const repository: GitHubWebhookRepository | null =
+      GitHubWebhookEvents.getRepository({
+        repository: { full_name: "OneUptime/oneuptime" },
+      });
+
+    expect(repository).toEqual({
+      organizationName: "OneUptime",
+      repositoryName: "oneuptime",
+    });
+  });
+
+  /*
+   * Neither half of a real full_name can contain a slash, so a name that
+   * does is either a different shape than we think or an attempt to make
+   * the repository read as one path and resolve as another. Splitting on
+   * the first slash keeps everything after it in the repository name,
+   * where it cannot become an extra path segment on its own.
+   */
+  test("keeps every later slash inside the repository name", () => {
+    expect(
+      GitHubWebhookEvents.getRepository({
+        repository: { full_name: "owner/repo/../../other" },
+      }),
+    ).toEqual({
+      organizationName: "owner",
+      repositoryName: "repo/../../other",
+    });
+  });
+
+  test.each([
+    ["no repository key at all", {}],
+    ["a repository that is not an object", { repository: "OneUptime/x" }],
+    ["no full_name", { repository: { id: 1 } }],
+    ["an empty full_name", { repository: { full_name: "" } }],
+    ["no slash", { repository: { full_name: "oneuptime" } }],
+    ["a leading slash, so no owner", { repository: { full_name: "/repo" } }],
+    [
+      "a trailing slash, so no repository",
+      { repository: { full_name: "owner/" } },
+    ],
+    ["only a slash", { repository: { full_name: "/" } }],
+  ])("returns null for %s", (_name: string, payload: JSONObject) => {
+    expect(GitHubWebhookEvents.getRepository(payload)).toBeNull();
+  });
+});
+
+describe("GitHubWebhookEvents.getInstallationId", () => {
+  test("stringifies the numeric id GitHub actually sends", () => {
+    expect(
+      GitHubWebhookEvents.getInstallationId({ installation: { id: 12345678 } }),
+    ).toBe("12345678");
+  });
+
+  /*
+   * The installation id is what binds a webhook to a customer's stored
+   * credentials, so "0" must not be read as "absent" and then fall through
+   * to whatever the caller does without one.
+   */
+  test("keeps a zero id rather than reading it as missing", () => {
+    expect(
+      GitHubWebhookEvents.getInstallationId({ installation: { id: 0 } }),
+    ).toBe("0");
+  });
+
+  test.each([
+    ["no installation", {}],
+    ["an installation without an id", { installation: { account: {} } }],
+    ["an empty string id", { installation: { id: "" } }],
+  ])("returns null for %s", (_name: string, payload: JSONObject) => {
+    expect(GitHubWebhookEvents.getInstallationId(payload)).toBeNull();
+  });
+});
+
+describe("GitHubWebhookEvents.getSender", () => {
+  test("reads the login and the account type", () => {
+    const sender: GitHubWebhookSender | null = GitHubWebhookEvents.getSender({
+      sender: { login: "octocat", type: "User" },
+    });
+
+    expect(sender).toEqual({ login: "octocat", type: "User" });
+  });
+
+  /*
+   * The app's own comments come back as webhooks, and the only thing
+   * separating "a person asked for something" from "we are reacting to
+   * ourselves" is this type being "Bot". It must survive a payload that
+   * omits it as undefined rather than becoming some other string.
+   */
+  test("leaves the type undefined when GitHub omits it", () => {
+    expect(
+      GitHubWebhookEvents.getSender({ sender: { login: "octocat" } }),
+    ).toEqual({ login: "octocat", type: undefined });
+  });
+
+  test("reports a Bot sender as a Bot", () => {
+    expect(
+      GitHubWebhookEvents.getSender({
+        sender: { login: "oneuptime[bot]", type: "Bot" },
+      })?.type,
+    ).toBe("Bot");
+  });
+
+  test.each([
+    ["no sender", {}],
+    ["a sender with no login", { sender: { type: "User" } }],
+    ["an empty login", { sender: { login: "", type: "User" } }],
+  ])("returns null for %s", (_name: string, payload: JSONObject) => {
+    expect(GitHubWebhookEvents.getSender(payload)).toBeNull();
+  });
+});
+
+describe("GitHubWebhookEvents.getAction", () => {
+  test("returns the action", () => {
+    expect(GitHubWebhookEvents.getAction({ action: "opened" })).toBe("opened");
+  });
+
+  test.each([
+    ["no action", {}],
+    ["an empty action", { action: "" }],
+  ])("returns null for %s", (_name: string, payload: JSONObject) => {
+    expect(GitHubWebhookEvents.getAction(payload)).toBeNull();
+  });
+});
+
+describe("GitHubWebhookEvents.isPullRequestIssue", () => {
+  /*
+   * issue_comment fires for both issues and pull requests and the payloads
+   * are otherwise identical. Reading this wrong means trying to implement
+   * an issue, or to revise a pull request that does not exist.
+   */
+  test("is true when the issue carries a pull_request link", () => {
+    expect(
+      GitHubWebhookEvents.isPullRequestIssue({
+        number: 7,
+        pull_request: { url: "https://api.github.com/repos/o/r/pulls/7" },
+      }),
+    ).toBe(true);
+  });
+
+  test.each([
+    ["a plain issue", { number: 7 }],
+    ["an explicitly null pull_request", { number: 7, pull_request: null }],
+    ["undefined", undefined],
+  ])("is false for %s", (_name: string, issue: JSONObject | undefined) => {
+    expect(GitHubWebhookEvents.isPullRequestIssue(issue)).toBe(false);
+  });
+});
+
+describe("GitHubWebhookEvents.getNumber", () => {
+  test("returns the issue or pull request number", () => {
+    expect(GitHubWebhookEvents.getNumber({ number: 3743 })).toBe(3743);
+  });
+
+  test("returns zero rather than null when the number is zero", () => {
+    expect(GitHubWebhookEvents.getNumber({ number: 0 })).toBe(0);
+  });
+
+  /*
+   * A number that arrives as a string is not coerced: everything
+   * downstream builds API paths out of it, and "3743 OR 1=1" is a string
+   * too. An unrecognised shape has to read as absent.
+   */
+  test.each([
+    ["a stringified number", { number: "3743" }],
+    ["no number", {}],
+    ["undefined", undefined],
+  ])(
+    "returns null for %s",
+    (_name: string, container: JSONObject | undefined) => {
+      expect(GitHubWebhookEvents.getNumber(container)).toBeNull();
+    },
+  );
+});
+
+describe("GitHubWebhookEvents.getLabelNames", () => {
+  test("returns every label name in order", () => {
+    expect(
+      GitHubWebhookEvents.getLabelNames({
+        labels: [{ name: "bug" }, { name: "oneuptime" }],
+      }),
+    ).toEqual(["bug", "oneuptime"]);
+  });
+
+  test("drops entries with no usable name instead of emitting blanks", () => {
+    expect(
+      GitHubWebhookEvents.getLabelNames({
+        labels: [{ name: "bug" }, { color: "ff0000" }, { name: "" }],
+      }),
+    ).toEqual(["bug"]);
+  });
+
+  test.each([
+    ["an issue with no labels key", {}],
+    ["an empty label array", { labels: [] }],
+    ["undefined", undefined],
+  ])(
+    "returns an empty array for %s",
+    (_name: string, issue: JSONObject | undefined) => {
+      expect(GitHubWebhookEvents.getLabelNames(issue)).toEqual([]);
+    },
+  );
+});
+
+describe("GitHubWebhookEvents.hasLabel", () => {
+  /*
+   * GitHub labels are case-preserving but case-insensitively unique, so
+   * "OneUptime" and "oneuptime" are the same label. An exact match would
+   * silently ignore half the ways a customer can type the trigger.
+   */
+  test.each(["oneuptime", "OneUptime", "ONEUPTIME", "  OneUptime  "])(
+    "matches %j against a differently-cased label",
+    (labelName: string) => {
+      expect(
+        GitHubWebhookEvents.hasLabel({
+          labelNames: ["Bug", "OnEuPtImE"],
+          labelName: labelName,
+        }),
+      ).toBe(true);
+    },
+  );
+
+  test("ignores surrounding whitespace on the label itself too", () => {
+    expect(
+      GitHubWebhookEvents.hasLabel({
+        labelNames: [" oneuptime "],
+        labelName: "oneuptime",
+      }),
+    ).toBe(true);
+  });
+
+  test("does not match a label that merely contains the wanted name", () => {
+    expect(
+      GitHubWebhookEvents.hasLabel({
+        labelNames: ["oneuptime-triage"],
+        labelName: "oneuptime",
+      }),
+    ).toBe(false);
+  });
+
+  /*
+   * A blank configured label would otherwise match every empty-ish string
+   * and hand the app every issue in the repository.
+   */
+  test.each(["", "   "])(
+    "never matches when the wanted label is %j",
+    (labelName: string) => {
+      expect(
+        GitHubWebhookEvents.hasLabel({
+          labelNames: ["", "   ", "oneuptime"],
+          labelName: labelName,
+        }),
+      ).toBe(false);
+    },
+  );
+
+  test("is false when nothing is labelled", () => {
+    expect(
+      GitHubWebhookEvents.hasLabel({ labelNames: [], labelName: "oneuptime" }),
+    ).toBe(false);
+  });
+});
+
+describe("GitHubWebhookEvents contract", () => {
+  /*
+   * These strings are the values GitHub puts in the X-GitHub-Event header
+   * and the default label customers are told to add. They are a wire
+   * contract with GitHub and with existing repositories: renaming one
+   * stops the app responding, with no error anywhere.
+   */
+  test("subscribes to the documented event names", () => {
+    expect(
+      Object.values(GitHubWebhookEvent).sort((a: string, b: string): number => {
+        return a.localeCompare(b);
+      }),
+    ).toEqual([
+      "installation",
+      "installation_repositories",
+      "issue_comment",
+      "issues",
+      "pull_request",
+      "pull_request_review",
+      "pull_request_review_comment",
+    ]);
+  });
+
+  test("keeps the default trigger label lowercase", () => {
+    expect(DEFAULT_GITHUB_TRIGGER_LABEL).toBe("oneuptime");
+  });
+
+  test("the default trigger label matches itself however it is cased", () => {
+    expect(
+      GitHubWebhookEvents.hasLabel({
+        labelNames: ["OneUptime"],
+        labelName: DEFAULT_GITHUB_TRIGGER_LABEL,
+      }),
+    ).toBe(true);
+  });
+});