@oneuptime/common 13.0.1 → 13.0.4

package/Tests/Types/OnCallDutyPolicy/LayerUtilExhaustiveRotation.test.ts

@@ -761,7 +761,7 @@ describe("Edge cases", () => {
     }
   });
 
-  it("NOTE: current behavior - getEvents emits a trailing negative-length event when the window end lands exactly on a rotation boundary; getMultiLayerEvents filters it out", () => {
+  it("getEvents does not emit a trailing negative-length event when the window end lands exactly on a rotation boundary", () => {
     const cfg: Cfg = {
       name: "boundary",
       intervalType: EventInterval.Day,
@@ -781,12 +781,15 @@ describe("Edge cases", () => {
     });
     const last: CalendarEvent = raw[raw.length - 1]!;
     /*
-     * NOTE: current behavior - the final event is inverted (end 1s before start).
-     * This is an internal artifact; both production consumers go through
-     * getMultiLayerEvents, which removes it (see assertion below). Not a
-     * user-observable defect, so it is documented rather than reported.
+     * The final event used to be inverted (end 1s before start). getEvents is
+     * consumed directly (layer shift preview, calendar feed coverage
+     * envelope), so it must never emit one.
      */
-    expect(OneUptimeDate.isBefore(last.end, last.start)).toBe(true);
+    expect(OneUptimeDate.isAfter(last.end, last.start)).toBe(true);
+    expect(OneUptimeDate.isSame(last.end, calEnd)).toBe(true);
+    for (const e of raw) {
+      expect(OneUptimeDate.isAfter(e.end, e.start)).toBe(true);
+    }
 
     const multi: CalendarEvent[] = util.getMultiLayerEvents({
       layers: [layerOf(cfg)],

package/Tests/Types/Rules/RuleCriteriaFieldRegistry.test.ts

@@ -0,0 +1,276 @@
+import fs from "fs";
+import path from "path";
+import { describe, expect, test } from "@jest/globals";
+import RULE_CRITERIA_FIELDS_BY_MODEL, {
+  RULE_CRITERIA_FIELDS_BY_MODEL as NAMED_RULE_CRITERIA_FIELDS_BY_MODEL,
+  getRuleCriteriaFieldsForModel,
+} from "../../../Types/Rules/RuleCriteriaFieldRegistry";
+
+const DATABASE_MODELS_ROOT: string = path.join(
+  __dirname,
+  "../../../Models/DatabaseModels",
+);
+
+const MODEL_NAMES: Array<string> = Object.keys(RULE_CRITERIA_FIELDS_BY_MODEL);
+
+/*
+ * Fields that describe what a rule DOES rather than what it matches. None of
+ * them may ever become an allowlisted match predicate: a filter on
+ * "ownerUsers" would let an API caller make a rule match on its own action.
+ */
+const ACTION_OR_BOOKKEEPING_FIELDS: Array<string> = [
+  "_id",
+  "id",
+  "projectId",
+  "project",
+  "name",
+  "description",
+  "isEnabled",
+  "priority",
+  "order",
+  "createdAt",
+  "updatedAt",
+  "deletedAt",
+  "createdByUser",
+  "createdByUserId",
+  "deletedByUser",
+  "deletedByUserId",
+  "ownerUsers",
+  "ownerTeams",
+  "labelsToAdd",
+  "onCallDutyPolicies",
+  "criteria",
+];
+
+function readModelSource(modelName: string): string {
+  return fs.readFileSync(
+    path.join(DATABASE_MODELS_ROOT, `${modelName}.ts`),
+    "utf8",
+  );
+}
+
+describe("RULE_CRITERIA_FIELDS_BY_MODEL", () => {
+  test("the default export and the named export are the same object", () => {
+    expect(RULE_CRITERIA_FIELDS_BY_MODEL).toBe(
+      NAMED_RULE_CRITERIA_FIELDS_BY_MODEL,
+    );
+  });
+
+  test("registers a non-trivial number of rule models", () => {
+    expect(MODEL_NAMES.length).toBeGreaterThanOrEqual(70);
+  });
+
+  test("every registered name is a *Rule model name", () => {
+    for (const modelName of MODEL_NAMES) {
+      expect(modelName).toMatch(/^[A-Z][A-Za-z0-9]*Rule$/);
+    }
+  });
+
+  test.each(MODEL_NAMES)(
+    "%s has at least one criteria field",
+    (modelName: string) => {
+      const fields: ReadonlyArray<string> | undefined =
+        RULE_CRITERIA_FIELDS_BY_MODEL[modelName];
+
+      expect(Array.isArray(fields)).toBe(true);
+      expect(fields!.length).toBeGreaterThan(0);
+    },
+  );
+
+  test.each(MODEL_NAMES)(
+    "%s lists each field exactly once",
+    (modelName: string) => {
+      const fields: ReadonlyArray<string> =
+        RULE_CRITERIA_FIELDS_BY_MODEL[modelName]!;
+
+      expect(new Set(fields).size).toBe(fields.length);
+    },
+  );
+
+  test.each(MODEL_NAMES)(
+    "%s only lists camelCase identifiers",
+    (modelName: string) => {
+      for (const field of RULE_CRITERIA_FIELDS_BY_MODEL[modelName]!) {
+        expect(field).toMatch(/^[a-z][A-Za-z0-9]*$/);
+      }
+    },
+  );
+
+  test.each(MODEL_NAMES)(
+    "%s never allowlists an action or bookkeeping field as a match predicate",
+    (modelName: string) => {
+      for (const field of RULE_CRITERIA_FIELDS_BY_MODEL[modelName]!) {
+        expect(ACTION_OR_BOOKKEEPING_FIELDS).not.toContain(field);
+      }
+    },
+  );
+
+  test.each(MODEL_NAMES)(
+    "%s names a database model that declares every registered field",
+    (modelName: string) => {
+      const modelPath: string = path.join(
+        DATABASE_MODELS_ROOT,
+        `${modelName}.ts`,
+      );
+
+      expect(fs.existsSync(modelPath)).toBe(true);
+
+      const source: string = readModelSource(modelName);
+
+      for (const field of RULE_CRITERIA_FIELDS_BY_MODEL[modelName]!) {
+        const declaration: RegExp = new RegExp(
+          `public\\s+${field}\\??\\s*[:=]`,
+        );
+
+        expect({
+          modelName,
+          field,
+          declared: declaration.test(source),
+        }).toEqual({ modelName, field, declared: true });
+      }
+    },
+  );
+
+  test("Label/Owner/OnCall/Privacy sibling rules for the same entity share one criteria contract", () => {
+    const siblingSuffixes: Array<string> = [
+      "LabelRule",
+      "OwnerRule",
+      "OnCallRule",
+      "PrivacyRule",
+      "GroupingRule",
+    ];
+    const groups: Map<string, Array<string>> = new Map<string, Array<string>>();
+
+    for (const modelName of MODEL_NAMES) {
+      const suffix: string | undefined = siblingSuffixes.find(
+        (candidate: string) => {
+          return modelName.endsWith(candidate);
+        },
+      );
+
+      if (!suffix) {
+        continue;
+      }
+
+      const entity: string = modelName.slice(0, -suffix.length);
+      const members: Array<string> = groups.get(entity) || [];
+      members.push(modelName);
+      groups.set(entity, members);
+    }
+
+    let comparedGroups: number = 0;
+
+    for (const [, members] of groups) {
+      if (members.length < 2) {
+        continue;
+      }
+
+      comparedGroups++;
+      const expected: ReadonlyArray<string> =
+        RULE_CRITERIA_FIELDS_BY_MODEL[members[0]!]!;
+
+      for (const member of members.slice(1)) {
+        expect({
+          member,
+          fields: RULE_CRITERIA_FIELDS_BY_MODEL[member],
+        }).toEqual({ member, fields: expected });
+      }
+    }
+
+    expect(comparedGroups).toBeGreaterThan(20);
+  });
+
+  test("alert rules match on alert severities and incident rules on incident severities, never the other way round", () => {
+    for (const modelName of MODEL_NAMES) {
+      const fields: ReadonlyArray<string> =
+        RULE_CRITERIA_FIELDS_BY_MODEL[modelName]!;
+
+      if (modelName.startsWith("Alert")) {
+        expect(fields).not.toContain("incidentSeverities");
+      }
+
+      if (modelName.startsWith("Incident")) {
+        expect(fields).not.toContain("alertSeverities");
+      }
+    }
+  });
+
+  test("AutoRemediationRule is the one rule that can match both incident and alert severities", () => {
+    const both: Array<string> = MODEL_NAMES.filter((modelName: string) => {
+      const fields: ReadonlyArray<string> =
+        RULE_CRITERIA_FIELDS_BY_MODEL[modelName]!;
+      return (
+        fields.includes("incidentSeverities") &&
+        fields.includes("alertSeverities")
+      );
+    });
+
+    expect(both).toEqual(["AutoRemediationRule"]);
+  });
+
+  test("pins a few representative contracts exactly", () => {
+    expect(RULE_CRITERIA_FIELDS_BY_MODEL["AlertReminderRule"]).toEqual([
+      "alertSeverities",
+      "labels",
+    ]);
+    expect(
+      RULE_CRITERIA_FIELDS_BY_MODEL["ScheduledMaintenanceReminderRule"],
+    ).toEqual(["labels"]);
+    expect(RULE_CRITERIA_FIELDS_BY_MODEL["NetworkSiteAssignmentRule"]).toEqual([
+      "subnetCidr",
+      "hostnamePattern",
+    ]);
+    expect(RULE_CRITERIA_FIELDS_BY_MODEL["RunbookRule"]).toEqual([
+      "titlePattern",
+      "descriptionPattern",
+    ]);
+    // IncidentSlaRule deliberately carries no monitor name/description patterns.
+    expect(RULE_CRITERIA_FIELDS_BY_MODEL["IncidentSlaRule"]).not.toContain(
+      "monitorNamePattern",
+    );
+  });
+});
+
+describe("getRuleCriteriaFieldsForModel", () => {
+  test.each(MODEL_NAMES)(
+    "returns the registered fields for %s",
+    (modelName: string) => {
+      expect(getRuleCriteriaFieldsForModel(modelName)).toBe(
+        RULE_CRITERIA_FIELDS_BY_MODEL[modelName],
+      );
+    },
+  );
+
+  test("returns undefined for a model that is not registered", () => {
+    expect(getRuleCriteriaFieldsForModel("Monitor")).toBeUndefined();
+    expect(getRuleCriteriaFieldsForModel("NotARealRule")).toBeUndefined();
+    expect(getRuleCriteriaFieldsForModel("")).toBeUndefined();
+  });
+
+  test("is case-sensitive: a near-miss spelling is not registered", () => {
+    expect(getRuleCriteriaFieldsForModel("alertlabelrule")).toBeUndefined();
+    expect(getRuleCriteriaFieldsForModel("ALERTLABELRULE")).toBeUndefined();
+    expect(getRuleCriteriaFieldsForModel(" AlertLabelRule")).toBeUndefined();
+  });
+
+  /*
+   * Regression: the lookup used a plain index, so inherited Object.prototype
+   * members answered with a function or object instead of undefined. A caller
+   * that treats "not undefined" as "registered" would then call .includes()
+   * on a function and throw a TypeError instead of rejecting the model.
+   */
+  test.each([
+    "constructor",
+    "toString",
+    "valueOf",
+    "hasOwnProperty",
+    "isPrototypeOf",
+    "__proto__",
+    "__defineGetter__",
+  ])(
+    "returns undefined for the inherited property name %s",
+    (modelName: string) => {
+      expect(getRuleCriteriaFieldsForModel(modelName)).toBeUndefined();
+    },
+  );
+});

package/Tests/Types/Rum/SessionReplayApiContracts.test.ts

@@ -10,6 +10,7 @@ import {
   SessionReplayExceptionSessionDto,
   SessionReplayForExceptionResponseDto,
   SessionReplayHeartbeatResponseDto,
+  SessionReplayListFiltersDto,
   SessionReplayListItemDto,
   SessionReplayListRequestDto,
   SessionReplayListResponseDto,
@@ -17,6 +18,11 @@ import {
   SessionReplayManifestRequestDto,
   SessionReplayManifestResponseDto,
   SessionReplayManifestTabDto,
+  SessionReplayUserKind,
+  SessionReplayUserRollupDto,
+  SessionReplayUsersCursorDto,
+  SessionReplayUsersRequestDto,
+  SessionReplayUsersResponseDto,
   SessionReplayViewDto,
   SessionReplayViewsRequestDto,
   SessionReplayViewsResponseDto,
@@ -32,7 +38,10 @@ import {
   readDtoStringMap,
   readDtoUnixMs,
 } from "../../../Types/Rum/SessionReplayApi";
-import { SessionReplayChunkManifestEntry } from "../../../Types/Rum/SessionReplay";
+import {
+  SESSION_REPLAY_VISITOR_ID_PATTERN,
+  SessionReplayChunkManifestEntry,
+} from "../../../Types/Rum/SessionReplay";
 
 /*
  * The DTOs are the wire between the Dashboard and TelemetryAPI's
@@ -54,6 +63,9 @@ import { SessionReplayChunkManifestEntry } from "../../../Types/Rum/SessionRepla
 const START_ISO: string = "2026-09-04T10:00:00.000Z";
 const END_ISO: string = "2026-09-04T10:04:12.000Z";
 
+/* A visitor id as the recorder mints it: 32 lowercase hex characters. */
+const VISITOR_ID: string = "0123456789abcdef0123456789abcdef";
+
 /* One row of /list as listSessions builds it, serialised. */
 const legacyListItem: SessionReplayListItemDto = {
   sessionId: "sess-1",
@@ -357,6 +369,173 @@ describe("SessionReplayApi - the additive contracts the surfaces already ship",
     expect(withNoneIgnored.ignoredFilters).not.toBeUndefined();
   });
 
+  /*
+   * The recorder-minted per-browser visitor id: an exact-match list filter
+   * ("every session from this browser") and a projection on every row.
+   * Neither is identity-gated - it is a random token the list already
+   * returns to every caller - and both are additive: an older server
+   * answers rows without it, which parse as "not measured".
+   */
+  it("/list: filters.visitorId and the visitorId projection are additive and shaped like the recorder mints them", () => {
+    expect(legacyListItem.visitorId).toBeUndefined();
+
+    const filters: SessionReplayListFiltersDto = { visitorId: VISITOR_ID };
+    const request: SessionReplayListRequestDto = {
+      rumApplicationId: "app-1",
+      filters: filters,
+    };
+
+    const withVisitor: SessionReplayListItemDto = {
+      ...legacyListItem,
+      visitorId: VISITOR_ID,
+    };
+    /* An older recorder's session: "", so the table has one branch. */
+    const fromOlderRecorder: SessionReplayListItemDto = {
+      ...legacyListItem,
+      visitorId: "",
+    };
+
+    expect(request.filters?.visitorId).toMatch(
+      SESSION_REPLAY_VISITOR_ID_PATTERN,
+    );
+    expect(withVisitor.visitorId).toBe(VISITOR_ID);
+    expect(fromOlderRecorder.visitorId).toBe("");
+  });
+
+  /*
+   * The manifest header carries the pseudonymous digest and the visitor
+   * id so the player can ask /list for this person's other sessions.
+   * Both are additive, and both are present WITHOUT the identity pair:
+   * neither names anyone, so neither is gated.
+   */
+  it("/manifest: identifiedUserKey and visitorId on the header are additive and independent of the identity pair", () => {
+    expect(legacyHeader.identifiedUserKey).toBeUndefined();
+    expect(legacyHeader.visitorId).toBeUndefined();
+
+    const withKeys: SessionReplayManifestHeaderDto = {
+      ...legacyHeader,
+      identifiedUserKey: "hmac-1",
+      visitorId: VISITOR_ID,
+    };
+    const neverIdentified: SessionReplayManifestHeaderDto = {
+      ...legacyHeader,
+      identifiedUserKey: "",
+      visitorId: "",
+    };
+
+    expect(withKeys.identifiedUserKey).toBe("hmac-1");
+    expect(withKeys.visitorId).toBe(VISITOR_ID);
+    expect(withKeys.identifiedUserLabel).toBeUndefined();
+    expect(withKeys.identifiedUserTraits).toBeUndefined();
+    expect(neverIdentified.identifiedUserKey).toBe("");
+    expect(neverIdentified.visitorId).toBe("");
+  });
+
+  /*
+   * POST /telemetry/rum/session-replay/users: the list rolled up by
+   * person. Its own route because a keyset page of sessions cannot be
+   * grouped client-side without lying at the page boundary. One row per
+   * identified user, one per linked browser, and at most one anonymous
+   * bucket whose key is "" - a row like any other, and a valid cursor
+   * tiebreak.
+   */
+  it("/users: the request is the list's window plus its own cursor, the response is one row per person with the identity pair gated", () => {
+    const cursor: SessionReplayUsersCursorDto = {
+      lastSeenUnixMs: Date.parse(END_ISO),
+      groupKey: "u:hmac-1",
+    };
+    const request: SessionReplayUsersRequestDto = {
+      rumApplicationId: "app-1",
+      startTime: START_ISO,
+      endTime: END_ISO,
+      limit: 50,
+      cursor: cursor,
+    };
+    const minimalRequest: SessionReplayUsersRequestDto = {
+      rumApplicationId: "app-1",
+    };
+
+    const identified: SessionReplayUserRollupDto = {
+      groupKey: "u:hmac-1",
+      kind: "identified",
+      identifiedUserKey: "hmac-1",
+      visitorId: VISITOR_ID,
+      sessionCount: 3,
+      liveSessionCount: 1,
+      firstSeenUnixMs: Date.parse(START_ISO),
+      lastSeenUnixMs: Date.parse(END_ISO),
+      totalDurationMs: 180000,
+      errorCount: 2,
+      frustrationCount: 4,
+      errorSessionCount: 1,
+      pageCount: 9,
+      lastSessionId: "sess-3",
+      lastEntryUrl: "https://acme.com/checkout",
+      browserName: "Chrome",
+      browserVersion: "128",
+      osName: "macOS",
+      deviceType: "desktop",
+      countryCode: "US",
+    };
+    const withLabel: SessionReplayUserRollupDto = {
+      ...identified,
+      identifiedUserLabel: "jane@acme.com",
+      identifiedUserTraits: { plan: "pro" },
+    };
+    const visitor: SessionReplayUserRollupDto = {
+      ...identified,
+      groupKey: `v:${VISITOR_ID}`,
+      kind: "visitor",
+      identifiedUserKey: "",
+    };
+    const anonymous: SessionReplayUserRollupDto = {
+      ...identified,
+      groupKey: "",
+      kind: "anonymous",
+      identifiedUserKey: "",
+      visitorId: "",
+    };
+
+    const page: SessionReplayUsersResponseDto = {
+      users: [withLabel, visitor, anonymous],
+      nextCursor: { lastSeenUnixMs: Date.parse(START_ISO), groupKey: "" },
+    };
+    const lastPage: SessionReplayUsersResponseDto = {
+      users: [identified],
+      nextCursor: null,
+    };
+
+    const kinds: Array<SessionReplayUserKind> = page.users.map(
+      (user: SessionReplayUserRollupDto): SessionReplayUserKind => {
+        return user.kind;
+      },
+    );
+
+    expect(kinds).toEqual(["identified", "visitor", "anonymous"]);
+    expect(request.cursor?.groupKey).toBe("u:hmac-1");
+    expect(minimalRequest.cursor).toBeUndefined();
+    expect(minimalRequest.limit).toBeUndefined();
+
+    /* The identity pair is absent unless the caller may read it. */
+    expect(identified.identifiedUserLabel).toBeUndefined();
+    expect(identified.identifiedUserTraits).toBeUndefined();
+    expect(withLabel.identifiedUserTraits?.["plan"]).toBe("pro");
+
+    /* The digest is "" unless identified; the visitor id may be "" too. */
+    expect(visitor.identifiedUserKey).toBe("");
+    expect(visitor.visitorId).toBe(VISITOR_ID);
+    expect(anonymous.visitorId).toBe("");
+
+    /* The bucket's own key is "", and it can be the cursor tiebreak. */
+    expect(anonymous.groupKey).toBe("");
+    expect(page.nextCursor?.groupKey).toBe("");
+    expect(lastPage.nextCursor).toBeNull();
+
+    /* Prefixes are opaque to the client: the row key and nothing more. */
+    expect(visitor.groupKey.startsWith("v:")).toBe(true);
+    expect(identified.groupKey.startsWith("u:")).toBe(true);
+  });
+
   /*
    * POST /telemetry/rum/session-replay/views: "who watched this
    * recording", off the audit rows every manifest read has written.