@oneuptime/common 13.0.5 → 13.0.6

package/Tests/Server/Utils/SessionReplay/SessionReplayReadServiceQueries.test.ts

@@ -1416,6 +1416,54 @@ describe("SessionReplayReadService statements", () => {
       expect(result.sessions[0]!.hasRecordingEnded).toBe(true);
     });
 
+    /*
+     * The follow-up now keys its facts per (session, tab) so the manifest
+     * can answer each tab's own hasRecordingEnded off the same read. GROUP
+     * BY sessionId, tabId makes that pair unique, so this only guards a
+     * result that repeats one: the rows fold with the same maxima the group
+     * applies, and the session verdict is what it always was.
+     */
+    test("repeated rows for one tab of a session fold like a single group", async () => {
+      mockPage([listRow("s-sealed", false), listRow("s-resumed", false)]);
+      mockChunkFacts([
+        /* Both rows of the tab sealed: the session is over. */
+        liveTabRow("s-sealed", "tab-1", {
+          tabLastChunkStartUnixMs: FINAL_END - 15000,
+        }),
+        endedTabRow("s-sealed", "tab-1"),
+        /* The tab kept recording past the tolerance: still recording. */
+        endedTabRow("s-resumed", "tab-1"),
+        liveTabRow("s-resumed", "tab-1", {
+          tabLastChunkStartUnixMs:
+            FINAL_END + SESSION_REPLAY_ENDED_TRAILING_CHUNK_TOLERANCE_MS + 1,
+        }),
+      ]);
+
+      const result: SessionReplayListResult =
+        await SessionReplayReadService.listSessions(request());
+
+      expect(endedBySessionId(result)).toEqual({
+        "s-sealed": true,
+        "s-resumed": false,
+      });
+    });
+
+    /*
+     * The manifest's per-tab flags ride on the same read; the list must
+     * still answer one flag per session and nothing per tab.
+     */
+    test("the list reports only the session-level flag, from one follow-up read", async () => {
+      mockPage([listRow("s-1", false)]);
+      mockChunkFacts([endedTabRow("s-1", "tab-1"), liveTabRow("s-1", "tab-2")]);
+
+      const result: SessionReplayListResult =
+        await SessionReplayReadService.listSessions(request());
+
+      expect(chunkQuerySpy).toHaveBeenCalledTimes(1);
+      expect(result.sessions[0]!.hasRecordingEnded).toBe(false);
+      expect(Object.keys(result.sessions[0]!)).not.toContain("tabs");
+    });
+
     test("the follow-up does not change the list statement or its filters", async () => {
       mockPage([listRow("s-1", false)]);
 
@@ -2667,6 +2715,310 @@ describe("SessionReplayReadService statements", () => {
         );
       });
     });
+
+    /*
+     * The recorder mints a NEW tab id on every page load, so a session's
+     * "tabs" are the pages the person walked through and the header's one
+     * "every tab has ended" cannot say WHICH of them is still open - the
+     * fact the player sorts open tabs before closed ones by. Each manifest
+     * tab therefore carries its own flag, judged per tab by the same shared
+     * rule, from the SAME single grouped read the header's flag comes from.
+     */
+    describe("hasRecordingEnded per manifest tab", () => {
+      const FINAL_END: number = 1700000150000;
+      /* Server write time of the newest chunk row (its version). */
+      const STORED_AT: number = FINAL_END + 1500;
+      const GRACE_PASSED: number =
+        STORED_AT + SESSION_REPLAY_ENDED_FINALIZE_GRACE_MS;
+
+      /* A tab that sealed: final chunk at FINAL_END, nothing after it. */
+      function endedTabRow(
+        tabId: string,
+        overrides: JSONObject = {},
+      ): JSONObject {
+        return {
+          sessionId: "s-1",
+          tabId: tabId,
+          tabHasFinalChunk: 1,
+          tabFinalChunkEndUnixMs: FINAL_END,
+          tabLastChunkStartUnixMs: FINAL_END - 16000,
+          tabMaxChunkIndex: 1,
+          tabLastChunkStoredAtUnixMs: STORED_AT,
+          ...overrides,
+        };
+      }
+
+      /* A tab still recording: no final chunk at all. */
+      function liveTabRow(
+        tabId: string,
+        overrides: JSONObject = {},
+      ): JSONObject {
+        return {
+          sessionId: "s-1",
+          tabId: tabId,
+          tabHasFinalChunk: 0,
+          tabFinalChunkEndUnixMs: 0,
+          tabLastChunkStartUnixMs: FINAL_END,
+          tabMaxChunkIndex: 1,
+          tabLastChunkStoredAtUnixMs: STORED_AT,
+          ...overrides,
+        };
+      }
+
+      function mockManifestThenFacts(facts: Array<JSONObject>): void {
+        chunkQuerySpy
+          .mockResolvedValueOnce(fakeResultSet(chunkRows) as never)
+          .mockResolvedValueOnce(fakeResultSet(facts) as never);
+      }
+
+      async function manifestAt(
+        nowUnixMs: number,
+        overrides: Partial<SessionReplaySessionHeader> = {},
+      ): Promise<SessionReplayManifest> {
+        return SessionReplayReadService.getManifest({
+          header: header({ isFinalized: false, ...overrides }),
+          projectId: projectId,
+          rumApplicationId: rumApplicationId,
+          sessionId: "s-1",
+          nowUnixMs: nowUnixMs,
+        });
+      }
+
+      function endedByTabId(
+        manifest: SessionReplayManifest,
+      ): Record<string, boolean> {
+        const ended: Record<string, boolean> = {};
+
+        for (const tab of manifest.tabs) {
+          ended[tab.tabId] = tab.hasRecordingEnded;
+        }
+
+        return ended;
+      }
+
+      test("a finalized session ends every tab without a second read", async () => {
+        chunkQuerySpy.mockResolvedValue(fakeResultSet(chunkRows) as never);
+
+        const manifest: SessionReplayManifest =
+          await SessionReplayReadService.getManifest({
+            header: header({ isFinalized: true, durationMs: 150000 }),
+            projectId: projectId,
+            rumApplicationId: rumApplicationId,
+            sessionId: "s-1",
+            nowUnixMs: GRACE_PASSED,
+          });
+
+        expect(chunkQuerySpy).toHaveBeenCalledTimes(1);
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": true,
+          "tab-2": true,
+        });
+      });
+
+      test("a sealed tab and a still-recording one are told apart while the session stays live", async () => {
+        mockManifestThenFacts([endedTabRow("tab-1"), liveTabRow("tab-2")]);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": true,
+          "tab-2": false,
+        });
+        /* One live tab keeps the session - and so the Live pill - going. */
+        expect(manifest.header.hasRecordingEnded).toBe(false);
+      });
+
+      /*
+       * The grace is about a NEW tab id that may still register, which says
+       * nothing about whether THIS tab sealed. A closed page is closed the
+       * moment its final chunk lands, so the tab flag has no grace.
+       */
+      test("a sealed tab is ended inside the session's grace, when the header still says live", async () => {
+        mockManifestThenFacts([endedTabRow("tab-1"), endedTabRow("tab-2")]);
+
+        const manifest: SessionReplayManifest = await manifestAt(
+          GRACE_PASSED - 1,
+        );
+
+        expect(manifest.header.hasRecordingEnded).toBe(false);
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": true,
+          "tab-2": true,
+        });
+      });
+
+      test("a session that has ended as a whole ends every tab, including one the facts read knows nothing about", async () => {
+        /* Only tab-1 has facts; tab-2's rows are in the manifest read. */
+        mockManifestThenFacts([endedTabRow("tab-1")]);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(manifest.header.hasRecordingEnded).toBe(true);
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": true,
+          "tab-2": true,
+        });
+      });
+
+      test("a tab with no facts of its own is not ended while the session is still recording", async () => {
+        mockManifestThenFacts([liveTabRow("tab-2")]);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(manifest.header.hasRecordingEnded).toBe(false);
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": false,
+          "tab-2": false,
+        });
+      });
+
+      /*
+       * A tab that reached the per-session chunk cap never gets a final
+       * chunk - the ingest gate refuses every index past the last one - and
+       * has ended all the same.
+       */
+      test("a capped tab with no final chunk is ended on its own", async () => {
+        mockManifestThenFacts([
+          liveTabRow("tab-1", {
+            tabMaxChunkIndex: MAX_SESSION_REPLAY_CHUNKS_PER_SESSION - 1,
+          }),
+          liveTabRow("tab-2"),
+        ]);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": true,
+          "tab-2": false,
+        });
+        expect(manifest.header.hasRecordingEnded).toBe(false);
+      });
+
+      test("an older recorder's trailing chunk inside the tolerance still ends the tab; one past it leaves it open", async () => {
+        mockManifestThenFacts([
+          endedTabRow("tab-1", {
+            tabLastChunkStartUnixMs:
+              FINAL_END + SESSION_REPLAY_ENDED_TRAILING_CHUNK_TOLERANCE_MS,
+          }),
+          endedTabRow("tab-2", {
+            tabLastChunkStartUnixMs:
+              FINAL_END + SESSION_REPLAY_ENDED_TRAILING_CHUNK_TOLERANCE_MS + 1,
+          }),
+        ]);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": true,
+          "tab-2": false,
+        });
+        expect(manifest.header.hasRecordingEnded).toBe(false);
+      });
+
+      test("a failed facts read leaves every tab false and still returns the manifest", async () => {
+        const warnSpy: jest.SpyInstance = jest
+          .spyOn(logger, "warn")
+          .mockImplementation((): void => {
+            return;
+          });
+
+        chunkQuerySpy
+          .mockResolvedValueOnce(fakeResultSet(chunkRows) as never)
+          .mockRejectedValueOnce(new Error("clickhouse down") as never);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(manifest.tabs).toHaveLength(2);
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": false,
+          "tab-2": false,
+        });
+        expect(manifest.header.hasRecordingEnded).toBe(false);
+        expect(warnSpy).toHaveBeenCalled();
+      });
+
+      test("ClickHouse's quoted facts are judged per tab, and an unmeasured clock is never ended", async () => {
+        mockManifestThenFacts([
+          {
+            sessionId: "s-1",
+            tabId: "tab-1",
+            tabHasFinalChunk: "1",
+            tabFinalChunkEndUnixMs: String(FINAL_END),
+            tabLastChunkStartUnixMs: String(FINAL_END - 16000),
+            tabMaxChunkIndex: "1",
+            tabLastChunkStoredAtUnixMs: String(STORED_AT),
+          },
+          endedTabRow("tab-2", { tabFinalChunkEndUnixMs: "not-a-number" }),
+        ]);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": true,
+          "tab-2": false,
+        });
+      });
+
+      /*
+       * GROUP BY sessionId, tabId makes the pair unique, so this only
+       * guards a result that repeats one: the rows fold with the same
+       * maxima the group would have applied, never on less evidence.
+       */
+      test("repeated rows for one tab fold like a single group", async () => {
+        mockManifestThenFacts([
+          liveTabRow("tab-1", { tabLastChunkStartUnixMs: FINAL_END - 16000 }),
+          endedTabRow("tab-1"),
+          endedTabRow("tab-2"),
+          liveTabRow("tab-2", {
+            tabLastChunkStartUnixMs:
+              FINAL_END + SESSION_REPLAY_ENDED_TRAILING_CHUNK_TOLERANCE_MS + 1,
+          }),
+        ]);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(endedByTabId(manifest)).toEqual({
+          "tab-1": true,
+          "tab-2": false,
+        });
+        expect(manifest.header.hasRecordingEnded).toBe(false);
+      });
+
+      test("the tab flags come from the one grouped read the header's flag comes from, and the manifest statement is unchanged", async () => {
+        mockManifestThenFacts([endedTabRow("tab-1"), liveTabRow("tab-2")]);
+
+        await manifestAt(GRACE_PASSED);
+
+        expect(chunkQuerySpy).toHaveBeenCalledTimes(2);
+
+        const manifestQuery: string = statementOf(chunkQuerySpy, 0).query;
+        expect(manifestQuery).toContain("LIMIT 1 BY tabId, chunkIndex");
+        expect(manifestQuery).not.toContain("tabHasFinalChunk");
+        expect(manifestQuery).not.toContain("GROUP BY sessionId, tabId");
+
+        const facts: Statement = statementOf(chunkQuerySpy, 1);
+        expect(facts.query).toContain("GROUP BY sessionId, tabId");
+        expect(facts.query).toContain(
+          "max(toUInt8(isFinal)) AS tabHasFinalChunk",
+        );
+        expect(facts.query).not.toMatch(/\bpayload\b(?!Bytes)/);
+        expect(boundValues(facts)).toContainEqual(["s-1"]);
+        expect(boundValues(facts)).toContain(rumApplicationId.toString());
+      });
+
+      test("the rest of each tab is untouched by the new flag", async () => {
+        mockManifestThenFacts([endedTabRow("tab-1"), liveTabRow("tab-2")]);
+
+        const manifest: SessionReplayManifest = await manifestAt(GRACE_PASSED);
+
+        expect(manifest.tabs[0]!.tabId).toBe("tab-1");
+        expect(manifest.tabs[0]!.chunkIndexes).toEqual([0, 1]);
+        expect(manifest.tabs[0]!.fullSnapshotChunkIndexes).toEqual([0]);
+        expect(manifest.tabs[0]!.firstChunkStartOffsetMs).toBe(0);
+        expect(manifest.tabs[1]!.firstChunkStartOffsetMs).toBe(134000);
+        expect(manifest.tabs[1]!.totalPayloadBytes).toBe(256);
+      });
+    });
   });
 
   describe("getChunks", () => {

package/Tests/Server/Utils/Slo/SloFeedUtil.test.ts

@@ -0,0 +1,326 @@
+/*
+ * `jest` is the global (as in ServiceLevelObjectiveService.test.ts), not the
+ * @jest/globals export: that export's SpiedFunction type does not accept what
+ * jest.spyOn returns with this repo's jest-mock version.
+ */
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * PasswordHash carries a pre-existing TS5.9 diagnostic that fails any suite
+ * whose runtime require graph reaches it, and DatabaseService - the base class
+ * of UserService - imports it.
+ */
+jest.mock("../../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: {
+      hash: jest.fn(),
+      verify: jest.fn(),
+      generateSalt: jest.fn(),
+      needsUpgrade: jest.fn(),
+      applyPepper: jest.fn(),
+    },
+  };
+});
+
+import ServiceLevelObjectiveOwnerUser from "../../../../Models/DatabaseModels/ServiceLevelObjectiveOwnerUser";
+import User from "../../../../Models/DatabaseModels/User";
+import UserService from "../../../../Server/Services/UserService";
+import SloFeedUtil from "../../../../Server/Utils/Slo/SloFeedUtil";
+import URL from "../../../../Types/API/URL";
+import Email from "../../../../Types/Email";
+import Name from "../../../../Types/Name";
+import ObjectID from "../../../../Types/ObjectID";
+
+/*
+ * Contract under test: the server half of the SLO feed.
+ *
+ *   - The seeding flag is how the burn rate rule service tells OneUptime's two
+ *     default rules apart from rules a person adds. It must be set exactly
+ *     while seeding runs, for exactly that SLO, and must never stick - a flag
+ *     left behind by a failed seed would silently hide every rule a user adds
+ *     to that SLO afterwards.
+ *
+ *   - The acting user's link is built from a name that user controls, so it is
+ *     escaped here rather than trusted like UserService.getUserMarkdownString.
+ */
+
+const SLO_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const OTHER_SLO_ID: ObjectID = new ObjectID(
+  "1a1a1a1a-1a1a-4a1a-8a1a-1a1a1a1a1a1a",
+);
+const PROJECT_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const USER_ID: ObjectID = new ObjectID("33333333-3333-4333-8333-333333333333");
+
+const USER_LINK: string = `https://oneuptime.test/dashboard/${PROJECT_ID.toString()}/settings/users/${USER_ID.toString()}`;
+
+function makeUser(fields: { name?: string; email?: string }): User {
+  const user: User = new User(USER_ID);
+
+  if (fields.name !== undefined) {
+    user.name = new Name(fields.name);
+  }
+
+  if (fields.email !== undefined) {
+    user.email = new Email(fields.email);
+  }
+
+  return user;
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("SloFeedUtil - default burn rate rule seeding flag", () => {
+  test("is set for the SLO only while its seed runs", async () => {
+    expect(SloFeedUtil.isSeedingDefaultBurnRateRules(SLO_ID)).toBe(false);
+
+    let seenDuringSeed: boolean = false;
+    let otherSloSeenDuringSeed: boolean = true;
+
+    const result: string =
+      await SloFeedUtil.runWhileSeedingDefaultBurnRateRules({
+        sloId: SLO_ID,
+        seed: (): Promise<string> => {
+          seenDuringSeed = SloFeedUtil.isSeedingDefaultBurnRateRules(
+            new ObjectID(SLO_ID.toString()),
+          );
+          otherSloSeenDuringSeed =
+            SloFeedUtil.isSeedingDefaultBurnRateRules(OTHER_SLO_ID);
+          return Promise.resolve("seeded");
+        },
+      });
+
+    expect(result).toBe("seeded");
+    expect(seenDuringSeed).toBe(true);
+    // A rule added to a different SLO at the same moment is still posted.
+    expect(otherSloSeenDuringSeed).toBe(false);
+    expect(SloFeedUtil.isSeedingDefaultBurnRateRules(SLO_ID)).toBe(false);
+  });
+
+  test("never sticks after a seed that throws", async () => {
+    await expect(
+      SloFeedUtil.runWhileSeedingDefaultBurnRateRules({
+        sloId: SLO_ID,
+        seed: (): Promise<void> => {
+          return Promise.reject(new Error("severity lookup failed"));
+        },
+      }),
+    ).rejects.toThrow("severity lookup failed");
+
+    expect(SloFeedUtil.isSeedingDefaultBurnRateRules(SLO_ID)).toBe(false);
+  });
+
+  test("an overlapping seed of the same SLO cannot clear the flag early", async () => {
+    let releaseOuter: () => void = (): void => {};
+    const outerSeed: Promise<void> =
+      SloFeedUtil.runWhileSeedingDefaultBurnRateRules({
+        sloId: SLO_ID,
+        seed: (): Promise<void> => {
+          return new Promise<void>((resolve: () => void) => {
+            releaseOuter = resolve;
+          });
+        },
+      });
+
+    await SloFeedUtil.runWhileSeedingDefaultBurnRateRules({
+      sloId: SLO_ID,
+      seed: (): Promise<void> => {
+        return Promise.resolve();
+      },
+    });
+
+    expect(SloFeedUtil.isSeedingDefaultBurnRateRules(SLO_ID)).toBe(true);
+
+    releaseOuter();
+    await outerSeed;
+
+    expect(SloFeedUtil.isSeedingDefaultBurnRateRules(SLO_ID)).toBe(false);
+  });
+
+  test("a rule with no SLO id is never treated as seeded", () => {
+    expect(SloFeedUtil.isSeedingDefaultBurnRateRules(undefined)).toBe(false);
+    expect(SloFeedUtil.isSeedingDefaultBurnRateRules(null)).toBe(false);
+  });
+});
+
+describe("SloFeedUtil - the acting user", () => {
+  test("links the user by name", async () => {
+    jest
+      .spyOn(UserService, "findOneById")
+      .mockResolvedValue(
+        makeUser({ name: "Jane Doe", email: "jane@example.com" }),
+      );
+    jest
+      .spyOn(UserService, "getUserLinkInDashboard")
+      .mockResolvedValue(URL.fromString(USER_LINK));
+
+    await expect(
+      SloFeedUtil.getUserMarkdown({ userId: USER_ID, projectId: PROJECT_ID }),
+    ).resolves.toBe(`[Jane Doe](${USER_LINK})`);
+  });
+
+  test("falls back to the email for a user who never set a name", async () => {
+    jest
+      .spyOn(UserService, "findOneById")
+      .mockResolvedValue(makeUser({ email: "jane_doe@example.com" }));
+    jest
+      .spyOn(UserService, "getUserLinkInDashboard")
+      .mockResolvedValue(URL.fromString(USER_LINK));
+
+    await expect(
+      SloFeedUtil.getUserMarkdown({ userId: USER_ID, projectId: PROJECT_ID }),
+    ).resolves.toBe(`[jane\\_doe@example.com](${USER_LINK})`);
+  });
+
+  test("a user name cannot re-point the link or add an image", async () => {
+    jest.spyOn(UserService, "findOneById").mockResolvedValue(
+      makeUser({
+        name: "x](https://evil.example) ![p](https://t.example/p.png)",
+      }),
+    );
+    jest
+      .spyOn(UserService, "getUserLinkInDashboard")
+      .mockResolvedValue(URL.fromString(USER_LINK));
+
+    await expect(
+      SloFeedUtil.getUserMarkdown({ userId: USER_ID, projectId: PROJECT_ID }),
+    ).resolves.toBe(
+      `[x\\]\\(https://evil.example\\) \\!\\[p\\]\\(https://t.example/p.png\\)](${USER_LINK})`,
+    );
+  });
+
+  test("no user id means no lookup at all - never a query that matches any user", async () => {
+    const findSpy: jest.SpyInstance = jest.spyOn(UserService, "findOneById");
+
+    await expect(
+      SloFeedUtil.getUserMarkdown({ userId: undefined, projectId: PROJECT_ID }),
+    ).resolves.toBeNull();
+
+    expect(findSpy).not.toHaveBeenCalled();
+  });
+
+  test("a user who no longer exists is null, so callers fall back to 'no user'", async () => {
+    jest.spyOn(UserService, "findOneById").mockResolvedValue(null);
+
+    await expect(
+      SloFeedUtil.getUserMarkdown({ userId: USER_ID, projectId: PROJECT_ID }),
+    ).resolves.toBeNull();
+  });
+
+  test("the display name is escaped, and empty for no user", () => {
+    expect(SloFeedUtil.getUserDisplayName(makeUser({ name: "*Jane*" }))).toBe(
+      "\\*Jane\\*",
+    );
+    expect(SloFeedUtil.getUserDisplayName(null)).toBe("");
+    expect(SloFeedUtil.getUserDisplayName(makeUser({}))).toBe("");
+  });
+});
+
+/*
+ * onBeforeUpdate and onBeforeDelete both run before DatabaseService applies
+ * the caller's permissions, so what a feed hook reads there - and what it
+ * later describes - has to be narrowed by hand.
+ */
+describe("SloFeedUtil - reads made before permissions are applied", () => {
+  const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+    "2b2b2b2b-2b2b-4b2b-8b2b-2b2b2b2b2b2b",
+  );
+
+  test("pins the caller's query to the caller's project, without touching the query itself", () => {
+    const query: Record<string, unknown> = { _id: SLO_ID.toString() };
+
+    expect(
+      SloFeedUtil.getTenantPinnedQuery({ query: query, tenantId: PROJECT_ID }),
+    ).toEqual({ _id: SLO_ID.toString(), projectId: PROJECT_ID });
+
+    // A copy: DatabaseService still receives the caller's query as it came.
+    expect(query).toEqual({ _id: SLO_ID.toString() });
+  });
+
+  test("a query naming another project is overridden, never trusted", () => {
+    expect(
+      SloFeedUtil.getTenantPinnedQuery({
+        query: { _id: SLO_ID.toString(), projectId: OTHER_PROJECT_ID },
+        tenantId: PROJECT_ID,
+      }),
+    ).toEqual({ _id: SLO_ID.toString(), projectId: PROJECT_ID });
+  });
+
+  test("without a tenant - a root automation - the query is used exactly as it is", () => {
+    const query: Record<string, unknown> = { _id: SLO_ID.toString() };
+
+    expect(
+      SloFeedUtil.getTenantPinnedQuery({ query: query, tenantId: undefined }),
+    ).toBe(query);
+    expect(
+      SloFeedUtil.getTenantPinnedQuery({ query: query, tenantId: null }),
+    ).toBe(query);
+  });
+});
+
+describe("SloFeedUtil - the rows a delete really removed", () => {
+  const OWNER_ROW_ID: ObjectID = new ObjectID(
+    "44444444-4444-4444-8444-444444444444",
+  );
+  const OTHER_OWNER_ROW_ID: ObjectID = new ObjectID(
+    "55555555-5555-4555-8555-555555555555",
+  );
+
+  function ownerRow(id?: ObjectID): ServiceLevelObjectiveOwnerUser {
+    const row: ServiceLevelObjectiveOwnerUser =
+      new ServiceLevelObjectiveOwnerUser(id);
+    row.serviceLevelObjectiveId = SLO_ID;
+    row.projectId = PROJECT_ID;
+    return row;
+  }
+
+  test("keeps only the rows whose ids the delete reports, in whatever case the ids arrive", () => {
+    const removed: ServiceLevelObjectiveOwnerUser = ownerRow(OWNER_ROW_ID);
+    const kept: ServiceLevelObjectiveOwnerUser = ownerRow(OTHER_OWNER_ROW_ID);
+
+    const rows: Array<ServiceLevelObjectiveOwnerUser> =
+      SloFeedUtil.getRowsActuallyDeleted({
+        rows: [removed, kept],
+        deletedIds: [new ObjectID(OWNER_ROW_ID.toString().toUpperCase())],
+      });
+
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toBe(removed);
+  });
+
+  test("a delete that removed nothing describes nothing - e.g. one naming another project's row", () => {
+    expect(
+      SloFeedUtil.getRowsActuallyDeleted({
+        rows: [ownerRow(OWNER_ROW_ID)],
+        deletedIds: [],
+      }),
+    ).toEqual([]);
+  });
+
+  test("a row read without its id is never described", () => {
+    expect(
+      SloFeedUtil.getRowsActuallyDeleted({
+        rows: [ownerRow()],
+        deletedIds: [OWNER_ROW_ID],
+      }),
+    ).toEqual([]);
+  });
+});
+
+describe("SloFeedUtil - monitor links", () => {
+  test("points at the monitor inside its project", () => {
+    expect(
+      SloFeedUtil.getMonitorLinkInDashboard({
+        dashboardUrl: URL.fromString("https://oneuptime.test/dashboard"),
+        projectId: PROJECT_ID,
+        monitorId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      }),
+    ).toBe(
+      `https://oneuptime.test/dashboard/${PROJECT_ID.toString()}/monitors/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa`,
+    );
+  });
+});