@oneuptime/common 13.0.4 → 13.0.5

package/Tests/App/Dashboard/UseServiceNames.test.tsx

@@ -0,0 +1,359 @@
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { act, cleanup, renderHook, waitFor } from "@testing-library/react";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+
+/*
+ * The Dashboard's useServiceNames feeds real `service.name` values into
+ * attribute scoping (e.g. `resource.service.name` on the companion metrics
+ * tab). It is now a thin wrapper over the generic telemetry entity
+ * resolver, and the danger is that it inherits the resolver's default of
+ * searching every table: a RUM application or host name used as a
+ * service.name would scope charts to the wrong thing. These tests pin that
+ * it only ever looks at the Service table and only returns Services.
+ */
+
+const getListMock: MockFunction = getJestMockFunction();
+
+/*
+ * The arrow wrapper is load bearing: jest.mock is hoisted above the
+ * compiled requires, so getListMock is still unassigned when the factory
+ * runs.
+ */
+jest.mock("../../../UI/Utils/ModelAPI/ModelAPI", () => {
+  return {
+    __esModule: true,
+    default: {
+      getList: (...args: Array<any>) => {
+        return getListMock(...args);
+      },
+    },
+  };
+});
+
+import useServiceNames from "../../../../App/FeatureSet/Dashboard/src/Components/Telemetry/useServiceNames";
+import TelemetryEntityNameResolver, {
+  TelemetryEntityNameMap,
+} from "../../../UI/Utils/Telemetry/TelemetryEntityNames";
+import Host from "../../../Models/DatabaseModels/Host";
+import RumApplication from "../../../Models/DatabaseModels/RumApplication";
+import Service from "../../../Models/DatabaseModels/Service";
+import ObjectID from "../../../Types/ObjectID";
+import ServiceType from "../../../Types/Telemetry/ServiceType";
+import ProjectUtil from "../../../UI/Utils/Project";
+
+const PROJECT_ID: string = "9e1b6b0e-0000-4000-8000-000000000001";
+const SERVICE_ID: string = "11111111-0000-4000-8000-000000000001";
+const SERVICE_ID_2: string = "11111111-0000-4000-8000-000000000002";
+const RUM_ID: string = "22222222-0000-4000-8000-000000000001";
+const HOST_ID: string = "33333333-0000-4000-8000-000000000001";
+
+type ModelType = unknown;
+
+interface HookProps {
+  ids: Array<ObjectID> | undefined;
+}
+
+interface Row {
+  id: ObjectID;
+  name: string;
+}
+
+interface GetListArgs {
+  modelType: ModelType;
+  query: { _id: { values: Array<string> } };
+  select: Record<string, boolean>;
+}
+
+const TABLES: Array<[ModelType, Array<Row>]> = [
+  [
+    Service,
+    [
+      { id: new ObjectID(SERVICE_ID), name: "checkout-api" },
+      { id: new ObjectID(SERVICE_ID_2), name: "payments-api" },
+    ],
+  ],
+  [RumApplication, [{ id: new ObjectID(RUM_ID), name: "checkout-web" }]],
+  [Host, [{ id: new ObjectID(HOST_ID), name: "prod-db-1" }]],
+];
+
+const queriedModels: () => Array<ModelType> = (): Array<ModelType> => {
+  return getListMock.mock.calls.map((call: Array<unknown>): ModelType => {
+    return (call[0] as GetListArgs).modelType;
+  });
+};
+
+/*
+ * Named structurally rather than as jest.SpiedFunction: jest.spyOn from
+ * @jest/globals returns jest-mock's SpyInstance, which does not assign to
+ * the global @types/jest declaration.
+ */
+interface ResolveSpy {
+  mock: { calls: Array<Array<unknown>> };
+  mockResolvedValue: (value: TelemetryEntityNameMap) => unknown;
+}
+
+const renderServiceNames: (initialProps: HookProps) => {
+  result: { current: Record<string, string> };
+  rerender: (props: HookProps) => void;
+} = (
+  initialProps: HookProps,
+): {
+  result: { current: Record<string, string> };
+  rerender: (props: HookProps) => void;
+} => {
+  return renderHook(
+    (props: HookProps): Record<string, string> => {
+      return useServiceNames(props.ids);
+    },
+    { initialProps },
+  );
+};
+
+const flushPromises: () => Promise<void> = async (): Promise<void> => {
+  for (let i: number = 0; i < 10; i++) {
+    await Promise.resolve();
+  }
+};
+
+beforeEach(() => {
+  TelemetryEntityNameResolver.clearCache();
+  getListMock.mockReset();
+  getListMock.mockImplementation((...callArgs: Array<unknown>) => {
+    const args: GetListArgs = callArgs[0] as GetListArgs;
+    const ids: Array<string> = args.query._id.values.map(
+      (value: string): string => {
+        return value.toString();
+      },
+    );
+    const table: [ModelType, Array<Row>] | undefined = TABLES.find(
+      (entry: [ModelType, Array<Row>]): boolean => {
+        return entry[0] === args.modelType;
+      },
+    );
+    return Promise.resolve({
+      data: (table ? table[1] : []).filter((item: Row): boolean => {
+        return ids.includes(item.id.toString());
+      }),
+    });
+  });
+  jest
+    .spyOn(ProjectUtil, "getCurrentProjectId")
+    .mockReturnValue(new ObjectID(PROJECT_ID));
+});
+
+afterEach(() => {
+  cleanup();
+  jest.restoreAllMocks();
+});
+
+describe("Dashboard useServiceNames", () => {
+  test("resolves Service ids to a plain id -> name record", async () => {
+    const { result } = renderServiceNames({
+      ids: [new ObjectID(SERVICE_ID), new ObjectID(SERVICE_ID_2)],
+    });
+    expect(result.current).toEqual({});
+    await waitFor(() => {
+      expect(result.current).toEqual({
+        [SERVICE_ID]: "checkout-api",
+        [SERVICE_ID_2]: "payments-api",
+      });
+    });
+  });
+
+  test("only ever queries the Service table", async () => {
+    const { result } = renderServiceNames({
+      ids: [
+        new ObjectID(SERVICE_ID),
+        new ObjectID(RUM_ID),
+        new ObjectID(HOST_ID),
+      ],
+    });
+    await waitFor(() => {
+      expect(result.current).toEqual({ [SERVICE_ID]: "checkout-api" });
+    });
+    await act(async () => {
+      await flushPromises();
+    });
+
+    expect(getListMock).toHaveBeenCalledTimes(1);
+    expect(queriedModels()).toEqual([Service]);
+  });
+
+  test("a RUM application id (not a Service) is excluded even though it exists", async () => {
+    const { result } = renderServiceNames({ ids: [new ObjectID(RUM_ID)] });
+    await act(async () => {
+      await flushPromises();
+    });
+    expect(result.current).toEqual({});
+    expect(queriedModels()).toEqual([Service]);
+    expect(queriedModels()).not.toContain(RumApplication);
+  });
+
+  test("the projectId (Unknown Service bucket) is excluded and never queried", async () => {
+    const { result } = renderServiceNames({
+      ids: [new ObjectID(PROJECT_ID), new ObjectID(SERVICE_ID)],
+    });
+    await waitFor(() => {
+      expect(result.current).toEqual({ [SERVICE_ID]: "checkout-api" });
+    });
+    expect(result.current[PROJECT_ID]).toBeUndefined();
+    const queriedIds: Array<string> = getListMock.mock.calls.flatMap(
+      (call: Array<unknown>): Array<string> => {
+        return (call[0] as GetListArgs).query._id.values.map(
+          (value: string): string => {
+            return value.toString();
+          },
+        );
+      },
+    );
+    expect(queriedIds).not.toContain(PROJECT_ID);
+  });
+
+  test("a RUM entity already cached by a generic lookup is not leaked", async () => {
+    await TelemetryEntityNameResolver.resolve({
+      ids: [RUM_ID, HOST_ID],
+      projectId: PROJECT_ID,
+    });
+    getListMock.mockClear();
+
+    const { result } = renderServiceNames({
+      ids: [new ObjectID(RUM_ID), new ObjectID(HOST_ID)],
+    });
+    await act(async () => {
+      await flushPromises();
+    });
+    expect(result.current).toEqual({});
+  });
+
+  test("asks the resolver for Service-only resolution", async () => {
+    const resolveSpy: ResolveSpy = jest.spyOn(
+      TelemetryEntityNameResolver,
+      "resolve",
+    ) as unknown as ResolveSpy;
+    resolveSpy.mockResolvedValue({});
+
+    renderServiceNames({ ids: [new ObjectID(SERVICE_ID)] });
+    await waitFor(() => {
+      expect(resolveSpy.mock.calls).toHaveLength(1);
+    });
+    const args: {
+      entityTypes?: Array<ServiceType> | undefined;
+      typeHints?: unknown;
+    } = resolveSpy.mock.calls[0]![0] as {
+      entityTypes?: Array<ServiceType> | undefined;
+      typeHints?: unknown;
+    };
+    expect(args.entityTypes).toEqual([ServiceType.OpenTelemetry]);
+    expect(args.typeHints).toBeUndefined();
+  });
+
+  test("defensively drops non-Service and Unknown entities from whatever the resolver returns", async () => {
+    const resolveSpy: ResolveSpy = jest.spyOn(
+      TelemetryEntityNameResolver,
+      "resolve",
+    ) as unknown as ResolveSpy;
+    resolveSpy.mockResolvedValue({
+      [SERVICE_ID]: {
+        id: SERVICE_ID,
+        name: "checkout-api",
+        entityType: ServiceType.OpenTelemetry,
+        typeLabel: "Service",
+      },
+      [PROJECT_ID]: {
+        id: PROJECT_ID,
+        name: "Unknown Service",
+        entityType: ServiceType.Unknown,
+        typeLabel: "Service",
+      },
+      [RUM_ID]: {
+        id: RUM_ID,
+        name: "checkout-web",
+        entityType: ServiceType.RealUserMonitor,
+        typeLabel: "RUM Application",
+      },
+      [HOST_ID]: {
+        id: HOST_ID,
+        name: "prod-db-1",
+        entityType: ServiceType.Host,
+        typeLabel: "Host",
+      },
+    });
+
+    const { result } = renderServiceNames({
+      ids: [
+        new ObjectID(SERVICE_ID),
+        new ObjectID(PROJECT_ID),
+        new ObjectID(RUM_ID),
+        new ObjectID(HOST_ID),
+      ],
+    });
+    await waitFor(() => {
+      expect(result.current).toEqual({ [SERVICE_ID]: "checkout-api" });
+    });
+  });
+
+  test("undefined or empty ids return {} without a request", async () => {
+    const { result, rerender } = renderServiceNames({ ids: undefined });
+    await act(async () => {
+      await flushPromises();
+    });
+    expect(result.current).toEqual({});
+
+    rerender({ ids: [] });
+    await act(async () => {
+      await flushPromises();
+    });
+    expect(result.current).toEqual({});
+    expect(getListMock).not.toHaveBeenCalled();
+  });
+
+  test("ids that do not resolve are absent so callers fall back to the id", async () => {
+    const missing: string = "99999999-0000-4000-8000-000000000001";
+    const { result } = renderServiceNames({
+      ids: [new ObjectID(missing), new ObjectID(SERVICE_ID)],
+    });
+    await waitFor(() => {
+      expect(result.current[SERVICE_ID]).toBe("checkout-api");
+    });
+    expect(Object.keys(result.current)).toEqual([SERVICE_ID]);
+  });
+
+  test("re-rendering with equivalent ObjectIDs keeps the same record and does not refetch", async () => {
+    const { result, rerender } = renderServiceNames({
+      ids: [new ObjectID(SERVICE_ID)],
+    });
+    await waitFor(() => {
+      expect(result.current).toEqual({ [SERVICE_ID]: "checkout-api" });
+    });
+    const first: Record<string, string> = result.current;
+
+    rerender({ ids: [new ObjectID(SERVICE_ID)] });
+    await act(async () => {
+      await flushPromises();
+    });
+
+    expect(result.current).toBe(first);
+    expect(getListMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("changing the ids resolves the new set", async () => {
+    const { result, rerender } = renderServiceNames({
+      ids: [new ObjectID(SERVICE_ID)],
+    });
+    await waitFor(() => {
+      expect(result.current).toEqual({ [SERVICE_ID]: "checkout-api" });
+    });
+    rerender({ ids: [new ObjectID(SERVICE_ID_2)] });
+    await waitFor(() => {
+      expect(result.current).toEqual({ [SERVICE_ID_2]: "payments-api" });
+    });
+    expect(queriedModels()).toEqual([Service, Service]);
+  });
+});

package/Tests/Models/DatabaseModels/DomainRoleTierCoverage.test.ts

@@ -77,6 +77,13 @@ const DOMAIN_BY_MODEL: Record<string, string> = {
   DetectionRule: "Security",
   ThreatIntelFeed: "Security",
   GoogleSecOpsConnection: "Security",
+  /*
+   * The managed connector framework that followed the Chronicle connector:
+   * one row per polled security product plus its run history. Same domain
+   * for the same reason.
+   */
+  SecurityEventConnection: "Security",
+  SecurityEventConnectionRun: "Security",
 };
 
 /*

package/Tests/Models/InventoryItemNaming.test.ts

@@ -127,6 +127,12 @@ describe("the old name is gone from the source tree", () => {
    *                                     schedule in Redis, because the
    *                                     dedup pass only removes repeatables
    *                                     matching the same name.
+   *
+   * The exact UI identifiers allowed below describe resolving the polymorphic
+   * primary entity attached to a telemetry row. They are display values, not
+   * the renamed Inventory database models or routes. Keeping an exact set
+   * means a future TelemetryEntityService (or a mixed line containing the old
+   * bare TelemetryEntity name) still fails this sweep.
    */
   interface AllowedReference {
     substring: string;
@@ -150,6 +156,24 @@ describe("the old name is gone from the source tree", () => {
     { substring: '"TelemetryEntity:' },
   ];
 
+  const ALLOWED_DISPLAY_IDENTIFIERS: ReadonlySet<string> = new Set<string>([
+    "TelemetryEntityNameMap",
+    "TelemetryEntityNameResolver",
+    "TelemetryEntityNames",
+    "TelemetryEntityTypeConfig",
+    "UseTelemetryEntityNames",
+    "UseTelemetryEntityNamesFunction",
+    "UseTelemetryEntityNamesOptions",
+    "useTelemetryEntityNames",
+    "ResolvedTelemetryEntity",
+    "getTelemetryEntityDisplay",
+    "getTelemetryEntityTypeForChipKey",
+    "getTelemetryEntityTypeLabel",
+  ]);
+
+  const IDENTIFIER_PATTERN: RegExp = /[$A-Za-z_][$A-Za-z0-9_]*/g;
+  const IDENTIFIER_END_PATTERN: RegExp = /[$A-Za-z0-9_]$/;
+
   /*
    * The two files whose job is to name the old name: this sweep itself, and
    * the migration test that checks each table is renamed rather than
@@ -191,6 +215,54 @@ describe("the old name is gone from the source tree", () => {
 
   type OffendingLinesFunction = (file: string) => Array<string>;
 
+  const escapeRegExp: (value: string) => string = (value: string): string => {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  };
+
+  const hasStaleTelemetryEntityReference: (
+    file: string,
+    line: string,
+  ) => boolean = (file: string, line: string): boolean => {
+    let lineWithoutAllowedReferences: string = line;
+
+    for (const allowed of ALLOWED_REFERENCES) {
+      if (allowed.onlyUnder && !file.includes(allowed.onlyUnder)) {
+        continue;
+      }
+
+      const needsIdentifierBoundary: boolean = IDENTIFIER_END_PATTERN.test(
+        allowed.substring,
+      );
+      const exactReferencePattern: RegExp = new RegExp(
+        `${escapeRegExp(allowed.substring)}${
+          needsIdentifierBoundary ? "(?![$A-Za-z0-9_])" : ""
+        }`,
+        "g",
+      );
+
+      lineWithoutAllowedReferences = lineWithoutAllowedReferences.replace(
+        exactReferencePattern,
+        "",
+      );
+    }
+
+    const identifiers: Array<string> = (
+      lineWithoutAllowedReferences.match(IDENTIFIER_PATTERN) || []
+    ).filter((identifier: string): boolean => {
+      return identifier.includes("TelemetryEntity");
+    });
+    const hasDisallowedIdentifier: boolean = identifiers.some(
+      (identifier: string): boolean => {
+        return !ALLOWED_DISPLAY_IDENTIFIERS.has(identifier);
+      },
+    );
+
+    return (
+      lineWithoutAllowedReferences.includes("telemetry-entity") ||
+      hasDisallowedIdentifier
+    );
+  };
+
   const getOffendingLines: OffendingLinesFunction = (
     file: string,
   ): Array<string> => {
@@ -198,22 +270,7 @@ describe("the old name is gone from the source tree", () => {
       .readFileSync(file, "utf8")
       .split("\n")
       .filter((line: string): boolean => {
-        if (
-          !line.includes("TelemetryEntity") &&
-          !line.includes("telemetry-entity")
-        ) {
-          return false;
-        }
-
-        return !ALLOWED_REFERENCES.some(
-          (allowed: AllowedReference): boolean => {
-            if (!line.includes(allowed.substring)) {
-              return false;
-            }
-
-            return !allowed.onlyUnder || file.includes(allowed.onlyUnder);
-          },
-        );
+        return hasStaleTelemetryEntityReference(file, line);
       })
       .map((line: string): string => {
         return line.trim();
@@ -227,6 +284,65 @@ describe("the old name is gone from the source tree", () => {
     ).toBeGreaterThan(50);
   });
 
+  test("the display vocabulary does not hide a stale model identifier", () => {
+    const uiFile: string = path.join(REPO_ROOT, "Common", "UI", "Example.ts");
+
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        "const value: ResolvedTelemetryEntity = resolved;",
+      ),
+    ).toBe(false);
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        "const value: TelemetryEntity = legacy;",
+      ),
+    ).toBe(true);
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        "const value: ResolvedTelemetryEntity = legacy as TelemetryEntity;",
+      ),
+    ).toBe(true);
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        "const value: TelemetryEntityV2 = legacy;",
+      ),
+    ).toBe(true);
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        "const value: V2TelemetryEntity = legacy;",
+      ),
+    ).toBe(true);
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        'import { ExtractedEntity } from "Common/Server/Utils/Telemetry/TelemetryEntity";',
+      ),
+    ).toBe(false);
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        'import TelemetryEntityService from "Common/Server/Utils/Telemetry/TelemetryEntity";',
+      ),
+    ).toBe(true);
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        'import { value } from "Common/Server/Utils/Telemetry/TelemetryEntityV2";',
+      ),
+    ).toBe(true);
+    expect(
+      hasStaleTelemetryEntityReference(
+        uiFile,
+        'const route = "/telemetry-entity";',
+      ),
+    ).toBe(true);
+  });
+
   test.each(["Common", "App"])(
     "%s has no stale TelemetryEntity reference",
     (projectDirectory: string) => {

package/Tests/Models/SecurityDomainAccessControl.test.ts

@@ -1,5 +1,6 @@
 import DetectionRule from "../../Models/DatabaseModels/DetectionRule";
 import GoogleSecOpsConnection from "../../Models/DatabaseModels/GoogleSecOpsConnection";
+import SecurityEventConnection from "../../Models/DatabaseModels/SecurityEventConnection";
 import ThreatIntelFeed from "../../Models/DatabaseModels/ThreatIntelFeed";
 import SecurityEvent from "../../Models/AnalyticsModels/SecurityEvent";
 import ThreatIntelIndicator from "../../Models/AnalyticsModels/ThreatIntelIndicator";
@@ -71,6 +72,8 @@ const buildSecurityModels: BuildSecurityModelsFunction =
     const threatIntelFeed: ThreatIntelFeed = new ThreatIntelFeed();
     const googleSecOpsConnection: GoogleSecOpsConnection =
       new GoogleSecOpsConnection();
+    const securityEventConnection: SecurityEventConnection =
+      new SecurityEventConnection();
     const securityEvent: SecurityEvent = new SecurityEvent();
     const threatIntelIndicator: ThreatIntelIndicator =
       new ThreatIntelIndicator();
@@ -100,6 +103,14 @@ const buildSecurityModels: BuildSecurityModelsFunction =
         delete: googleSecOpsConnection.deleteRecordPermissions,
         columns: columnsOf(googleSecOpsConnection),
       },
+      {
+        name: "SecurityEventConnection",
+        read: securityEventConnection.readRecordPermissions,
+        create: securityEventConnection.createRecordPermissions,
+        update: securityEventConnection.updateRecordPermissions,
+        delete: securityEventConnection.deleteRecordPermissions,
+        columns: columnsOf(securityEventConnection),
+      },
       {
         name: "SecurityEvent",
         read: securityEvent.getReadPermissions(),
@@ -165,6 +176,7 @@ describe("Security domain access control", () => {
       "DetectionRule",
       "GoogleSecOpsConnection",
       "SecurityEvent",
+      "SecurityEventConnection",
       "ThreatIntelFeed",
       "ThreatIntelIndicator",
     ]);
@@ -246,8 +258,9 @@ describe("Security domain access control", () => {
       for (const [column, accessControl] of model.columns) {
         /*
          * `read: []` is a deliberate "nobody reads this through the API" -
-         * GoogleSecOpsConnection.serviceAccountJson is the one that matters.
-         * Those must stay closed, which the credential test below asserts.
+         * GoogleSecOpsConnection.serviceAccountJson and
+         * SecurityEventConnection.secrets are the ones that matter. Those
+         * must stay closed, which the credential tests below assert.
          */
         if (!accessControl?.read || accessControl.read.length === 0) {
           continue;
@@ -297,6 +310,30 @@ describe("Security domain access control", () => {
     expect(accessControl?.read).toEqual([]);
   });
 
+  /*
+   * The framework connections store every provider's credential (client
+   * secrets, API tokens, AWS secret keys) as one encrypted JSON string.
+   * Like the SecOps key it is write-only: SecurityAdmin configures and
+   * rotates it, nobody reads it back through the API. The non-secret
+   * config column, by contrast, is what the edit form and the table show,
+   * so it follows the table into the Security tiers.
+   */
+  test("the framework connection secrets stay unreadable by everyone", () => {
+    const model: SecurityEventConnection = new SecurityEventConnection();
+    const secrets: ColumnAccessControl | null =
+      model.getColumnAccessControlFor("secrets");
+    const config: ColumnAccessControl | null =
+      model.getColumnAccessControlFor("config");
+
+    expect(secrets).toBeDefined();
+    expect(secrets?.read).toEqual([]);
+    expect(secrets?.create).toContain(Permission.SecurityAdmin);
+    expect(secrets?.update).toContain(Permission.SecurityAdmin);
+    expect(model.getTableColumnMetadata("secrets").encrypted).toBe(true);
+
+    expect(config?.read).toEqual(expect.arrayContaining(SECURITY_TIERS));
+  });
+
   /*
    * Tier semantics, so "Viewer" keeps meaning read-only and the three tiers
    * stay distinguishable from each other. A family whose Viewer can delete is
@@ -344,22 +381,29 @@ describe("Security domain access control", () => {
    * Pointing the project at a Chronicle instance, and holding the credential
    * that reads it, is administration of the SIEM rather than use of it.
    */
-  test("only the Admin tier configures the SecOps connector", () => {
-    const model: GoogleSecOpsConnection = new GoogleSecOpsConnection();
-
-    for (const list of [
-      model.createRecordPermissions,
-      model.updateRecordPermissions,
-      model.deleteRecordPermissions,
-    ]) {
-      expect(list).toContain(Permission.SecurityAdmin);
-      expect(list).not.toContain(Permission.SecurityMember);
-      expect(list).not.toContain(Permission.SecurityViewer);
-    }
+  test.each<[string, GoogleSecOpsConnection | SecurityEventConnection]>([
+    ["GoogleSecOpsConnection", new GoogleSecOpsConnection()],
+    ["SecurityEventConnection", new SecurityEventConnection()],
+  ])(
+    "only the Admin tier configures the %s connector",
+    (
+      _name: string,
+      model: GoogleSecOpsConnection | SecurityEventConnection,
+    ) => {
+      for (const list of [
+        model.createRecordPermissions,
+        model.updateRecordPermissions,
+        model.deleteRecordPermissions,
+      ]) {
+        expect(list).toContain(Permission.SecurityAdmin);
+        expect(list).not.toContain(Permission.SecurityMember);
+        expect(list).not.toContain(Permission.SecurityViewer);
+      }
 
-    expect(model.readRecordPermissions).toContain(Permission.SecurityMember);
-    expect(model.readRecordPermissions).toContain(Permission.SecurityViewer);
-  });
+      expect(model.readRecordPermissions).toContain(Permission.SecurityMember);
+      expect(model.readRecordPermissions).toContain(Permission.SecurityViewer);
+    },
+  );
 
   /*
    * The Member tier is what makes the family usable without handing out admin: