@oneuptime/common 13.0.3 → 13.0.5

package/Tests/Server/Utils/AI/TimelineTools.test.ts

@@ -1,6 +1,7 @@
 import {
   GetAlertTimelineTool,
   GetIncidentTimelineTool,
+  formatTimelineEntryCount,
 } from "../../../../Server/Utils/AI/Toolbox/TimelineTools";
 import {
   ToolContext,
@@ -306,6 +307,59 @@ describe("get_incident_timeline", () => {
     expect(result.dataForLlm).toContain("Newest public note.");
     expect(result.dataForLlm).not.toContain("Oldest note");
     expect(result.dataForLlm).toContain("Showing the newest 2 of 3");
+    // The label counts the entries shown, not the ones fetched.
+    expect(result.citationLabel).toBe("Incident #42 timeline (2 entries)");
+  });
+
+  test("a single entry reads as '1 entry' in the citation label", async () => {
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(buildIncident() as never);
+
+    mockIncidentSources({
+      feedItems: [
+        buildFeedItem({
+          info: "Incident created",
+          at: new Date("2026-08-01T09:45:00Z"),
+        }),
+      ],
+    });
+
+    const result: ToolExecutionResult = await GetIncidentTimelineTool.execute(
+      { incidentId: INCIDENT_ID.toString() },
+      ctx,
+    );
+
+    expect(result.rowCount).toBe(1);
+    expect(result.citationLabel).toBe("Incident #42 timeline (1 entry)");
+    expect(result.citationLabel).not.toContain("1 entries");
+  });
+
+  test("falls back to the incident id when it has no number", async () => {
+    const incident: Incident = new Incident();
+    incident._id = INCIDENT_ID.toString();
+    incident.title = "Checkout is down";
+    jest
+      .spyOn(IncidentService, "findOneById")
+      .mockResolvedValue(incident as never);
+
+    mockIncidentSources({
+      publicNotes: [
+        buildPublicNote({
+          note: "Investigating.",
+          at: new Date("2026-08-01T11:00:00Z"),
+        }),
+      ],
+    });
+
+    const result: ToolExecutionResult = await GetIncidentTimelineTool.execute(
+      { incidentId: INCIDENT_ID.toString() },
+      ctx,
+    );
+
+    expect(result.citationLabel).toBe(
+      `Incident ${INCIDENT_ID.toString()} timeline (1 entry)`,
+    );
   });
 
   test("missing incidentId returns an error envelope, not a query", async () => {
@@ -355,6 +409,7 @@ describe("get_incident_timeline", () => {
 
     expect(result.rowCount).toBe(0);
     expect(result.widget).toBeUndefined();
+    expect(result.citationLabel).toBe("Incident #42 timeline (0 entries)");
   });
 
   test("required permissions derive from the incident read ACL", () => {
@@ -442,6 +497,58 @@ describe("get_alert_timeline", () => {
     expect(callArgs["props"]).toBe(ctx.props);
   });
 
+  test("a single alert entry reads as '1 entry' in the citation label", async () => {
+    jest
+      .spyOn(AlertService, "findOneById")
+      .mockResolvedValue(buildAlert() as never);
+
+    const feedItem: AlertFeed = new AlertFeed();
+    feedItem._id = ObjectID.generate().toString();
+    feedItem.feedInfoInMarkdown = "Alert created";
+    feedItem.postedAt = new Date("2026-08-02T09:55:00Z");
+    feedItem.createdAt = new Date("2026-08-02T09:55:00Z");
+    feedItem.alertFeedEventType = AlertFeedEventType.AlertCreated;
+
+    jest
+      .spyOn(AlertStateTimelineService, "findBy")
+      .mockResolvedValue([] as never);
+    jest
+      .spyOn(AlertInternalNoteService, "findBy")
+      .mockResolvedValue([] as never);
+    jest
+      .spyOn(AlertFeedService, "findBy")
+      .mockResolvedValue([feedItem] as never);
+
+    const result: ToolExecutionResult = await GetAlertTimelineTool.execute(
+      { alertId: ALERT_ID.toString() },
+      ctx,
+    );
+
+    expect(result.rowCount).toBe(1);
+    expect(result.citationLabel).toBe("Alert #7 timeline (1 entry)");
+  });
+
+  test("an alert with no activity labels its timeline '0 entries'", async () => {
+    jest
+      .spyOn(AlertService, "findOneById")
+      .mockResolvedValue(buildAlert() as never);
+    jest
+      .spyOn(AlertStateTimelineService, "findBy")
+      .mockResolvedValue([] as never);
+    jest
+      .spyOn(AlertInternalNoteService, "findBy")
+      .mockResolvedValue([] as never);
+    jest.spyOn(AlertFeedService, "findBy").mockResolvedValue([] as never);
+
+    const result: ToolExecutionResult = await GetAlertTimelineTool.execute(
+      { alertId: ALERT_ID.toString() },
+      ctx,
+    );
+
+    expect(result.rowCount).toBe(0);
+    expect(result.citationLabel).toBe("Alert #7 timeline (0 entries)");
+  });
+
   test("missing alertId returns an error envelope", async () => {
     const result: ToolExecutionResult = await GetAlertTimelineTool.execute(
       {},
@@ -470,3 +577,15 @@ describe("get_alert_timeline", () => {
     expect(GetAlertTimelineTool.requiredPermissions.length).toBeGreaterThan(0);
   });
 });
+
+describe("formatTimelineEntryCount", () => {
+  test.each([
+    [0, "0 entries"],
+    [1, "1 entry"],
+    [2, "2 entries"],
+    [11, "11 entries"],
+    [50, "50 entries"],
+  ])("%i reads as %s", (count: number, expected: string) => {
+    expect(formatTimelineEntryCount(count)).toBe(expected);
+  });
+});

package/Tests/Server/Utils/AI/Toolbox/AIToolbox.test.ts

@@ -62,6 +62,11 @@ import {
 } from "../../../../../Server/Utils/AI/Toolbox/ToolTypes";
 import { LLMToolDefinition } from "../../../../../Server/Utils/LLM/LLMService";
 
+// A second project the same user belongs to.
+const otherProjectId: ObjectID = new ObjectID(
+  "33333333-3333-3333-3333-333333333333",
+);
+
 function contextFor(data: {
   allow?: Array<Permission>;
   block?: Array<Permission>;
@@ -107,6 +112,46 @@ function contextFor(data: {
   return { projectId: projectId, props: props };
 }
 
+/*
+ * The shape of the evidence re-run bug: the caller holds every grant in the
+ * tenant their request names, but the tool is pointed at a different project
+ * (or the request is multi-tenant). The grants checked must be the grants of
+ * the project queried, so all of these must be refused.
+ */
+function mismatchedContexts(): Array<[string, ToolContext]> {
+  const allowed: ToolContext = contextFor({
+    allow: [Permission.ProjectOwner, Permission.ProjectMember],
+  });
+
+  return [
+    [
+      "a tool pointed at a project other than the request's tenant",
+      { projectId: otherProjectId, props: allowed.props },
+    ],
+    [
+      "a multi-tenant request, even inside the tenant",
+      {
+        projectId: projectId,
+        props: { ...allowed.props, isMultiTenantRequest: true },
+      },
+    ],
+    [
+      "a multi-tenant request pointed at another project",
+      {
+        projectId: otherProjectId,
+        props: { ...allowed.props, isMultiTenantRequest: true },
+      },
+    ],
+    [
+      "a request with no tenant at all",
+      {
+        projectId: projectId,
+        props: { ...allowed.props, tenantId: undefined },
+      },
+    ],
+  ];
+}
+
 const tools: Array<ObservabilityTool> = AIToolbox.getTools();
 
 describe("AIToolbox contract", () => {
@@ -348,6 +393,62 @@ describe("AIToolbox.hasPermissionForTool", () => {
       true,
     );
   });
+
+  test.each(mismatchedContexts())(
+    "refuses %s despite the tenant's grants",
+    (_name: string, ctx: ToolContext) => {
+      expect(AIToolbox.hasPermissionForTool(tool, ctx)).toBe(false);
+    },
+  );
+
+  test("still lets a system (root) run query any project it is pointed at", () => {
+    expect(
+      AIToolbox.hasPermissionForTool(tool, {
+        projectId: otherProjectId,
+        props: { isRoot: true },
+      }),
+    ).toBe(true);
+  });
+});
+
+describe("AIToolbox.isContextScopedToOneProject", () => {
+  test("accepts a caller whose tenant is the tool's project", () => {
+    expect(AIToolbox.isContextScopedToOneProject(contextFor({}))).toBe(true);
+  });
+
+  // Chat/Slack/Teams build the context from an ObjectID of the same value.
+  test("compares project ids by value, not identity", () => {
+    const ctx: ToolContext = contextFor({});
+
+    expect(
+      AIToolbox.isContextScopedToOneProject({
+        projectId: new ObjectID(projectId.toString()),
+        props: ctx.props,
+      }),
+    ).toBe(true);
+  });
+
+  test.each(mismatchedContexts())(
+    "rejects %s",
+    (_name: string, ctx: ToolContext) => {
+      expect(AIToolbox.isContextScopedToOneProject(ctx)).toBe(false);
+    },
+  );
+
+  test.each([
+    ["root", { isRoot: true }],
+    ["a master admin", { isMasterAdmin: true }],
+  ])("does not constrain %s", (_name: string, flags: JSONObject) => {
+    expect(
+      AIToolbox.isContextScopedToOneProject({
+        projectId: otherProjectId,
+        props: {
+          ...flags,
+          isMultiTenantRequest: true,
+        } as DatabaseCommonInteractionProps,
+      }),
+    ).toBe(true);
+  });
 });
 
 describe("AIToolbox.executeTool", () => {
@@ -409,6 +510,56 @@ describe("AIToolbox.executeTool", () => {
     expect(outcome.textForLlm).toContain("which permission is missing");
   });
 
+  test.each(mismatchedContexts())(
+    "refuses %s without running the tool",
+    async (_name: string, ctx: ToolContext) => {
+      let ran: boolean = false;
+      lookupBehaviour = async (): Promise<JSONObject> => {
+        ran = true;
+        return {
+          dataForLlm: "rows from the wrong project",
+          rowCount: 1,
+          citationLabel: "Services",
+          redactionCount: 0,
+          isTruncated: false,
+        };
+      };
+
+      const outcome: ToolCallOutcome = await AIToolbox.executeTool({
+        name: "lookup_context",
+        args: { type: "services" },
+        ctx,
+      });
+
+      expect(ran).toBe(false);
+      expect(outcome.success).toBe(false);
+      expect(outcome.result).toBeUndefined();
+      expect(outcome.errorMessage).toContain("Permission denied");
+      expect(outcome.errorMessage).toContain("not scoped to this project");
+      expect(outcome.textForLlm).not.toContain("rows from the wrong project");
+    },
+  );
+
+  test("runs a root context pointed at any project", async () => {
+    lookupBehaviour = async (): Promise<JSONObject> => {
+      return {
+        dataForLlm: "services: checkout",
+        rowCount: 1,
+        citationLabel: "Services",
+        redactionCount: 0,
+        isTruncated: false,
+      };
+    };
+
+    const outcome: ToolCallOutcome = await AIToolbox.executeTool({
+      name: "lookup_context",
+      args: { type: "services" },
+      ctx: { projectId: otherProjectId, props: { isRoot: true } },
+    });
+
+    expect(outcome.success).toBe(true);
+  });
+
   test("refuses a blocked tool even when the user is otherwise permitted", async () => {
     const outcome: ToolCallOutcome = await AIToolbox.executeTool({
       name: "lookup_context",

package/Tests/Server/Utils/AnalyticsDatabase/StatementGenerator.test.ts

@@ -1306,6 +1306,71 @@ describe("StatementGenerator", () => {
         expect(statement.query).toBe("AND {p0:Identifier} = {p1:String}");
       });
 
+      /*
+       * Serverless functions and IoT fleets have a resource attribute but no
+       * signal entity key, so their scope arrives with `entityKeys: []`. That
+       * must drop the membership branch — an empty `hasAny(entityKeys, [])`
+       * is always false and would only add noise to the OR.
+       */
+      test("an attribute-only scope (no entity keys) compiles to id OR attribute, with no hasAny", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [
+            {
+              entityIds: [CLUSTER_ID],
+              entityKeys: [],
+              attributeKey: "resource.iot.fleet.name",
+              attributeValues: ["warehouse-sensors"],
+            },
+          ],
+        } as any);
+
+        expect(statement.query).toBe(
+          "AND ({p0:Identifier} IN {p1:Array(String)} OR {p2:Identifier}[{p3:String}] IN {p4:Array(String)})",
+        );
+        expect(statement.query).not.toContain("hasAny");
+        expect(statement.query_params).toStrictEqual({
+          p0: "primaryEntityId",
+          p1: [CLUSTER_ID],
+          p2: "attributes",
+          p3: "resource.iot.fleet.name",
+          p4: ["warehouse-sensors"],
+        });
+      });
+
+      test("an attribute-only scope with no ids compiles to the attribute branch alone", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [
+            {
+              entityIds: [],
+              entityKeys: [],
+              attributeKey: "resource.faas.name",
+              attributeValues: ["checkout-handler"],
+            },
+          ],
+        } as any);
+
+        expect(statement.query).toBe(
+          "AND ({p0:Identifier}[{p1:String}] IN {p2:Array(String)})",
+        );
+      });
+
+      test("an attribute key without values adds no attribute branch", () => {
+        const statement: Statement = resourceGenerator.toWhereStatement({
+          resourceEntityScopes: [
+            {
+              entityIds: [CLUSTER_ID],
+              entityKeys: [],
+              attributeKey: "resource.faas.name",
+              attributeValues: [],
+            },
+          ],
+        } as any);
+
+        expect(statement.query).toBe(
+          "AND ({p0:Identifier} IN {p1:Array(String)})",
+        );
+      });
+
       test("a non-array value carries no predicate", () => {
         const statement: Statement = resourceGenerator.toWhereStatement({
           resourceEntityScopes: { entityIds: [CLUSTER_ID] },

package/Tests/Server/Utils/AnalyticsDatabase/StatementGeneratorExceptionScope.test.ts

@@ -0,0 +1,224 @@
+import { ClickhouseAppInstance } from "../../../../Server/Infrastructure/ClickhouseDatabase";
+import { Statement } from "../../../../Server/Utils/AnalyticsDatabase/Statement";
+import StatementGenerator from "../../../../Server/Utils/AnalyticsDatabase/StatementGenerator";
+import "../../TestingUtils/Init";
+import AnalyticsBaseModel from "../../../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
+import Route from "../../../../Types/API/Route";
+import AnalyticsTableEngine from "../../../../Types/AnalyticsDatabase/AnalyticsTableEngine";
+import AnalyticsTableName from "../../../../Types/AnalyticsDatabase/AnalyticsTableName";
+import AnalyticsTableColumn from "../../../../Types/AnalyticsDatabase/TableColumn";
+import TableColumnType from "../../../../Types/AnalyticsDatabase/TableColumnType";
+import ObjectID from "../../../../Types/ObjectID";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * "exceptionScope" narrows a span query to the spans one exception group's
+ * occurrences were raised in. It must only ever narrow: a missing project or
+ * a malformed scope has to match nothing, never fall back to every span.
+ */
+
+const PROJECT_ID: string = "10000000-0000-4000-8000-000000000001";
+const SERVICE_ID: string = "60000000-0000-4000-8000-000000000001";
+const FINGERPRINT: string = "fp-9f86d081884c7d65";
+
+function column(key: string, type: TableColumnType): AnalyticsTableColumn {
+  return new AnalyticsTableColumn({
+    key,
+    title: "<title>",
+    description: "<description>",
+    required: true,
+    type,
+  });
+}
+
+class SpanLikeModel extends AnalyticsBaseModel {
+  public constructor() {
+    super({
+      tableName: "<span-like-table>",
+      singularName: "<singular>",
+      pluralName: "<plural>",
+      tableColumns: [
+        column("projectId", TableColumnType.ObjectID),
+        column("traceId", TableColumnType.Text),
+        column("spanId", TableColumnType.Text),
+        column("name", TableColumnType.Text),
+      ],
+      crudApiPath: new Route("route"),
+      primaryKeys: ["projectId"],
+      sortKeys: ["projectId"],
+      partitionKey: "projectId",
+      tableEngine: AnalyticsTableEngine.MergeTree,
+    });
+  }
+}
+
+class NoSpanColumnsModel extends AnalyticsBaseModel {
+  public constructor() {
+    super({
+      tableName: "<no-span-table>",
+      singularName: "<singular>",
+      pluralName: "<plural>",
+      tableColumns: [
+        column("projectId", TableColumnType.ObjectID),
+        column("name", TableColumnType.Text),
+      ],
+      crudApiPath: new Route("route"),
+      primaryKeys: ["projectId"],
+      sortKeys: ["projectId"],
+      partitionKey: "projectId",
+      tableEngine: AnalyticsTableEngine.MergeTree,
+    });
+  }
+}
+
+describe("StatementGenerator exceptionScope synthetic key", () => {
+  const spanGenerator: StatementGenerator<SpanLikeModel> =
+    new StatementGenerator<SpanLikeModel>({
+      modelType: SpanLikeModel,
+      database: ClickhouseAppInstance,
+    });
+
+  const where: (query: Record<string, unknown>) => Statement = (
+    query: Record<string, unknown>,
+  ): Statement => {
+    return spanGenerator.toWhereStatement(query as any);
+  };
+
+  const subqueryParams: (statement: Statement) => Array<unknown> = (
+    statement: Statement,
+  ): Array<unknown> => {
+    return Object.values(statement.query_params).map((value: unknown) => {
+      return value instanceof ObjectID ? value.toString() : value;
+    });
+  };
+
+  test("compiles to a (traceId, spanId) GLOBAL IN subquery pinned to the project", () => {
+    const statement: Statement = where({
+      exceptionScope: { fingerprint: FINGERPRINT },
+      projectId: new ObjectID(PROJECT_ID),
+    });
+
+    expect(statement.query).toContain(
+      "AND ({p0:Identifier}, {p1:Identifier}) GLOBAL IN (SELECT traceId, spanId FROM {p2:Identifier} WHERE projectId = {p3:String} AND fingerprint = {p4:String})",
+    );
+    expect(subqueryParams(statement).slice(0, 5)).toEqual([
+      "traceId",
+      "spanId",
+      AnalyticsTableName.ExceptionInstance,
+      PROJECT_ID,
+      FINGERPRINT,
+    ]);
+  });
+
+  test("never emits a plain IN, which multi-shard clusters reject", () => {
+    const statement: Statement = where({
+      exceptionScope: { fingerprint: FINGERPRINT, primaryEntityId: SERVICE_ID },
+      projectId: PROJECT_ID,
+    });
+
+    expect(statement.query).toMatch(/\) GLOBAL IN \(SELECT/);
+    expect(statement.query).not.toMatch(/\) IN \(SELECT/);
+  });
+
+  test("adds the exception's service when the scope names one", () => {
+    const statement: Statement = where({
+      projectId: PROJECT_ID,
+      exceptionScope: { fingerprint: FINGERPRINT, primaryEntityId: SERVICE_ID },
+    });
+
+    expect(statement.query.replace(/\s+/g, " ")).toMatch(
+      /AND fingerprint = \{p\d+:String\} AND primaryEntityId = \{p\d+:String\}\)$/,
+    );
+    expect(subqueryParams(statement)).toContain(SERVICE_ID);
+  });
+
+  test("reads the project id whether it is an ObjectID or a string", () => {
+    for (const projectId of [new ObjectID(PROJECT_ID), PROJECT_ID]) {
+      const statement: Statement = where({
+        projectId,
+        exceptionScope: { fingerprint: FINGERPRINT },
+      });
+
+      expect(subqueryParams(statement)).toContain(PROJECT_ID);
+      expect(statement.query).not.toContain("AND 0");
+    }
+  });
+
+  test("composes with the other predicates, in either key order", () => {
+    const statement: Statement = where({
+      name: "POST /api/checkout",
+      exceptionScope: { fingerprint: FINGERPRINT },
+      projectId: PROJECT_ID,
+    });
+    const query: string = statement.query.replace(/\s+/g, " ");
+
+    expect(query.startsWith("AND {p0:Identifier} = {p1:String} AND (")).toBe(
+      true,
+    );
+    expect(query).toContain(") GLOBAL IN (SELECT traceId, spanId FROM");
+    expect(query).toMatch(/AND \{p\d+:Identifier\} = \{p\d+:String\}$/);
+  });
+
+  test("matches nothing without a project, rather than every span", () => {
+    const statement: Statement = where({
+      exceptionScope: { fingerprint: FINGERPRINT },
+    });
+
+    expect(statement.query).toBe("AND 0");
+    expect(statement.query_params).toStrictEqual({});
+  });
+
+  test.each([
+    ["a blank fingerprint", { fingerprint: "  " }],
+    ["a non-object scope", "fp"],
+    ["a non-UUID service", { fingerprint: FINGERPRINT, primaryEntityId: "x" }],
+  ])("matches nothing for %s", (_name: string, scope: unknown) => {
+    const statement: Statement = where({
+      projectId: PROJECT_ID,
+      exceptionScope: scope,
+    });
+
+    expect(statement.query).toContain("AND 0");
+    expect(statement.query).not.toContain("IN (SELECT");
+  });
+
+  test("keeps separators intact when it is not the first predicate", () => {
+    const statement: Statement = where({
+      projectId: PROJECT_ID,
+      exceptionScope: { fingerprint: "  " },
+      name: "x",
+    });
+
+    expect(statement.query.replace(/\s+/g, " ")).toMatch(
+      /^AND \{p0:Identifier\} = \{p1:String\} AND 0 AND \{p2:Identifier\} = \{p3:String\}$/,
+    );
+  });
+
+  test("is ignored for models without traceId and spanId columns", () => {
+    const generator: StatementGenerator<NoSpanColumnsModel> =
+      new StatementGenerator<NoSpanColumnsModel>({
+        modelType: NoSpanColumnsModel,
+        database: ClickhouseAppInstance,
+      });
+
+    const statement: Statement = generator.toWhereStatement({
+      exceptionScope: { fingerprint: FINGERPRINT },
+    } as any);
+
+    expect(statement.query).toBe("");
+  });
+
+  test("qualifies the outer columns when a table alias is used", () => {
+    const statement: Statement = spanGenerator.toWhereStatement(
+      {
+        projectId: PROJECT_ID,
+        exceptionScope: { fingerprint: FINGERPRINT },
+      } as any,
+      { tableAlias: "s" },
+    );
+
+    expect(statement.query).toContain(
+      "({p2_t:Identifier}.{p2_c:Identifier}, {p3_t:Identifier}.{p3_c:Identifier}) GLOBAL IN (SELECT traceId, spanId FROM",
+    );
+  });
+});