@oneuptime/common 13.0.6 → 13.0.8

package/Tests/Server/Types/Database/Permissions/SelectRejectionMessageContract.test.ts

@@ -51,6 +51,7 @@ const PROVIDER_GENERATOR: string = path.join(
   "..",
   "..",
   "..",
+  "..",
   "Scripts",
   "TerraformProvider",
   "Core",

package/Tests/Server/Types/Database/Permissions/TableLevelBlockPermission.test.ts

@@ -0,0 +1,459 @@
+import DatabaseRequestType from "../../../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import AccessControlPermission from "../../../../../Server/Types/Database/Permissions/AccessControlPermission";
+import CreatePermission from "../../../../../Server/Types/Database/Permissions/CreatePermission";
+import DeletePermission from "../../../../../Server/Types/Database/Permissions/DeletePermission";
+import ReadPermission from "../../../../../Server/Types/Database/Permissions/ReadPermission";
+import TablePermission from "../../../../../Server/Types/Database/Permissions/TablePermission";
+import UpdatePermission from "../../../../../Server/Types/Database/Permissions/UpdatePermission";
+import QueryUtil from "../../../../../Server/Types/Database/QueryUtil";
+import Incident from "../../../../../Models/DatabaseModels/Incident";
+import Label from "../../../../../Models/DatabaseModels/Label";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../../Types/Permission";
+
+/*
+ * AccessTokenService.refreshUserTenantAccessPermission emits one row per
+ * TeamPermission across every team the user belongs to, without merging or
+ * ordering them. The same permission can therefore be blocked twice: once by
+ * a team that scopes the block to some labels and once by a team that blocks
+ * it outright. The table-wide block must win no matter which row comes first.
+ */
+describe("TablePermission.checkTableLevelBlockPermissions", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const labelA: ObjectID = ObjectID.generate();
+  const labelB: ObjectID = ObjectID.generate();
+
+  function makeProps(
+    permissions: Array<UserPermission>,
+  ): DatabaseCommonInteractionProps {
+    const tenantPermission: UserTenantAccessPermission = {
+      projectId,
+      _type: "UserTenantAccessPermission",
+      permissions,
+    };
+
+    return {
+      userId,
+      tenantId: projectId,
+      userTenantAccessPermission: {
+        [projectId.toString()]: tenantPermission,
+      },
+    };
+  }
+
+  function blockPermission(
+    permission: Permission,
+    labelIds: Array<ObjectID> | undefined,
+  ): UserPermission {
+    return {
+      _type: "UserPermission",
+      permission,
+      labelIds: labelIds as Array<ObjectID>,
+      isBlockPermission: true,
+    };
+  }
+
+  function allowPermission(
+    permission: Permission,
+    labelIds: Array<ObjectID>,
+  ): UserPermission {
+    return {
+      _type: "UserPermission",
+      permission,
+      labelIds,
+      isBlockPermission: false,
+    };
+  }
+
+  function incidentWithLabels(labelIds: Array<ObjectID>): Incident {
+    const incident: Incident = new Incident();
+    incident.labels = labelIds.map((id: ObjectID) => {
+      const label: Label = new Label();
+      label.id = id;
+      return label;
+    });
+    return incident;
+  }
+
+  const requestTypes: Array<DatabaseRequestType> = [
+    DatabaseRequestType.Create,
+    DatabaseRequestType.Read,
+    DatabaseRequestType.Update,
+    DatabaseRequestType.Delete,
+  ];
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("with a single block row", () => {
+    it.each(requestTypes)(
+      "refuses %s when the block row carries no labels",
+      (type: DatabaseRequestType) => {
+        expect(() => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([blockPermission(Permission.ProjectMember, [])]),
+            type,
+          );
+        }).toThrow(NotAuthorizedException);
+      },
+    );
+
+    it.each(requestTypes)(
+      "does not refuse %s outright when the block row carries labels",
+      (type: DatabaseRequestType) => {
+        expect(() => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([blockPermission(Permission.ProjectMember, [labelA])]),
+            type,
+          );
+        }).not.toThrow();
+      },
+    );
+
+    it("treats a block row whose labelIds is missing as table-wide", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([blockPermission(Permission.ProjectMember, undefined)]),
+          DatabaseRequestType.Read,
+        );
+      }).toThrow(NotAuthorizedException);
+    });
+  });
+
+  describe("with several block rows for the same permission", () => {
+    it.each(requestTypes)(
+      "refuses %s when a labelled block row comes before an unlabelled one",
+      (type: DatabaseRequestType) => {
+        expect(() => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([
+              blockPermission(Permission.ProjectMember, [labelA]),
+              blockPermission(Permission.ProjectMember, []),
+            ]),
+            type,
+          );
+        }).toThrow(NotAuthorizedException);
+      },
+    );
+
+    it.each(requestTypes)(
+      "refuses %s when the unlabelled block row comes first",
+      (type: DatabaseRequestType) => {
+        expect(() => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([
+              blockPermission(Permission.ProjectMember, []),
+              blockPermission(Permission.ProjectMember, [labelA]),
+            ]),
+            type,
+          );
+        }).toThrow(NotAuthorizedException);
+      },
+    );
+
+    it("refuses when the unlabelled row is buried behind several labelled ones", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.ProjectMember, [labelB]),
+            blockPermission(Permission.ProjectMember, [labelA, labelB]),
+            blockPermission(Permission.ProjectMember, undefined),
+          ]),
+          DatabaseRequestType.Update,
+        );
+      }).toThrow(NotAuthorizedException);
+    });
+
+    it("leaves the request to the label check when every block row carries labels", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.ProjectMember, [labelB]),
+          ]),
+          DatabaseRequestType.Read,
+        );
+      }).not.toThrow();
+    });
+
+    it("names the blocked permission in the refusal", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.ProjectMember, []),
+          ]),
+          DatabaseRequestType.Delete,
+        );
+      }).toThrow(
+        `${Permission.ProjectMember} is in your team's permission block list.`,
+      );
+    });
+  });
+
+  describe("with block rows for different permissions of the model", () => {
+    it("refuses when another permission of the model is blocked table-wide", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.IncidentMember, []),
+          ]),
+          DatabaseRequestType.Update,
+        );
+      }).toThrow(
+        `${Permission.IncidentMember} is in your team's permission block list.`,
+      );
+    });
+
+    /*
+     * IncidentViewer is only in Incident's read list, so a table-wide block on
+     * it takes reading away and leaves the other operations alone.
+     */
+    it.each([
+      { type: DatabaseRequestType.Read, refused: true },
+      { type: DatabaseRequestType.Create, refused: false },
+      { type: DatabaseRequestType.Update, refused: false },
+      { type: DatabaseRequestType.Delete, refused: false },
+    ])(
+      "matches block rows against the $type permission list only",
+      ({ type, refused }: { type: DatabaseRequestType; refused: boolean }) => {
+        const check: () => void = (): void => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([
+              blockPermission(Permission.ProjectMember, [labelA]),
+              blockPermission(Permission.IncidentViewer, []),
+            ]),
+            type,
+          );
+        };
+
+        if (refused) {
+          expect(check).toThrow(NotAuthorizedException);
+        } else {
+          expect(check).not.toThrow();
+        }
+      },
+    );
+  });
+
+  describe("rows that must not trigger a table-wide block", () => {
+    it("ignores an unlabelled block row for a permission the model does not use", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.MonitorViewer, []),
+          ]),
+          DatabaseRequestType.Read,
+        );
+      }).not.toThrow();
+    });
+
+    it("ignores an unlabelled allow row for the blocked permission", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            allowPermission(Permission.ProjectMember, []),
+          ]),
+          DatabaseRequestType.Read,
+        );
+      }).not.toThrow();
+    });
+  });
+
+  /*
+   * Every CRUD entry point relies on this helper for the table-wide case: the
+   * read query rewrite and the update/delete label check only look at block
+   * rows that carry labels, so a missed unlabelled row is never enforced
+   * anywhere else.
+   */
+  describe("through the CRUD entry points", () => {
+    /*
+     * The user is granted the permission table-wide, so any refusal below can
+     * only come from the block rows.
+     */
+    const grant: UserPermission = allowPermission(Permission.ProjectMember, []);
+    const mixedBlockRows: Array<UserPermission> = [
+      grant,
+      blockPermission(Permission.ProjectMember, [labelA]),
+      blockPermission(Permission.ProjectMember, []),
+    ];
+
+    it("allows update and delete when only the grant is present", async () => {
+      await expect(
+        UpdatePermission.checkUpdatePermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: async () => {
+            return incidentWithLabels([labelB]);
+          },
+          props: makeProps([grant]),
+        }),
+      ).resolves.toBeUndefined();
+
+      await expect(
+        DeletePermission.checkDeletePermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: async () => {
+            return incidentWithLabels([labelB]);
+          },
+          props: makeProps([grant]),
+        }),
+      ).resolves.toBeUndefined();
+    });
+
+    it("refuses create", () => {
+      expect(() => {
+        CreatePermission.checkCreateBlockPermissions(
+          Incident,
+          makeProps(mixedBlockRows),
+        );
+      }).toThrow(NotAuthorizedException);
+    });
+
+    it("refuses read instead of only filtering the labelled rows out", async () => {
+      jest.spyOn(QueryUtil, "getManyToManyRelationMetadata").mockReturnValue({
+        joinTableName: "IncidentLabel",
+        ownerColumnName: "incidentId",
+        relationColumnName: "labelId",
+      });
+
+      await expect(
+        ReadPermission.checkReadBlockPermission(
+          Incident,
+          { projectId } as any,
+          makeProps(mixedBlockRows),
+        ),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it("refuses update of a record that carries none of the blocked labels", async () => {
+      const fetchModel: jest.Mock = jest.fn(async () => {
+        return incidentWithLabels([labelB]);
+      });
+
+      await expect(
+        UpdatePermission.checkUpdatePermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: fetchModel,
+          props: makeProps(mixedBlockRows),
+        }),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it("refuses delete of a record that carries none of the blocked labels", async () => {
+      const fetchModel: jest.Mock = jest.fn(async () => {
+        return incidentWithLabels([labelB]);
+      });
+
+      await expect(
+        DeletePermission.checkDeletePermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: fetchModel,
+          props: makeProps(mixedBlockRows),
+        }),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it("refuses before loading the record for a label comparison", async () => {
+      const fetchModel: jest.Mock = jest.fn(async () => {
+        return incidentWithLabels([]);
+      });
+
+      await expect(
+        AccessControlPermission.checkAccessControlBlockPermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: fetchModel,
+          type: DatabaseRequestType.Update,
+          props: makeProps(mixedBlockRows),
+        }),
+      ).rejects.toThrow(NotAuthorizedException);
+      expect(fetchModel).not.toHaveBeenCalled();
+    });
+
+    it.each([{ isRoot: true }, { isMasterAdmin: true }])(
+      "still lets %o requests through",
+      async (bypass: DatabaseCommonInteractionProps) => {
+        const props: DatabaseCommonInteractionProps = {
+          ...makeProps(mixedBlockRows),
+          ...bypass,
+        };
+
+        expect(() => {
+          CreatePermission.checkCreateBlockPermissions(Incident, props);
+        }).not.toThrow();
+
+        await expect(
+          ReadPermission.checkReadBlockPermission(
+            Incident,
+            { projectId } as any,
+            props,
+          ),
+        ).resolves.toBeDefined();
+
+        await expect(
+          AccessControlPermission.checkAccessControlBlockPermissionByModel({
+            modelType: Incident,
+            fetchModelWithAccessControlIds: jest.fn(),
+            type: DatabaseRequestType.Delete,
+            props,
+          }),
+        ).resolves.toBeUndefined();
+      },
+    );
+  });
+
+  describe("label-scoped blocks keep working after the table-level check", () => {
+    const labelledBlockRows: Array<UserPermission> = [
+      blockPermission(Permission.ProjectMember, [labelA]),
+      blockPermission(Permission.IncidentMember, [labelB]),
+    ];
+
+    it("refuses update of a record that carries a blocked label", async () => {
+      await expect(
+        AccessControlPermission.checkAccessControlBlockPermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: async () => {
+            return incidentWithLabels([labelB]);
+          },
+          type: DatabaseRequestType.Update,
+          props: makeProps(labelledBlockRows),
+        }),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it("allows update of a record that carries none of the blocked labels", async () => {
+      await expect(
+        AccessControlPermission.checkAccessControlBlockPermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: async () => {
+            return incidentWithLabels([ObjectID.generate()]);
+          },
+          type: DatabaseRequestType.Update,
+          props: makeProps(labelledBlockRows),
+        }),
+      ).resolves.toBeUndefined();
+    });
+  });
+});

package/Tests/Server/Types/Database/Permissions/UserNotificationRuleScoping.test.ts

@@ -43,7 +43,7 @@ import Permission from "../../../../../Types/Permission";
  * else. The FIRST group below is the standing proof that this still holds for a
  * plain member on all ten models.
  *
- * GAP D in Internal/Roadmap/OnCallNotificationReadiness.md was the consequence
+ * GAP D in Docs/Internal/Roadmap/OnCallNotificationReadiness.md was the consequence
  * for everybody else: a Project ADMIN was treated identically to a plain member
  * on these tables, because ProjectAdmin appeared in none of these lists and so
  * never landed in the intersection. There was no query an admin could issue

package/Tests/Server/Utils/AI/AIIncidentGating.test.ts

@@ -1,3 +1,4 @@
+import InvestigationEligibility from "../../../../Server/Utils/AI/SRE/InvestigationEligibility";
 import AIIncidentInvestigationRunner, {
   DEFAULT_INCIDENT_DEDUPE_WINDOW_MINUTES,
   IncidentGateDecision,
@@ -15,7 +16,7 @@ import Project from "../../../../Models/DatabaseModels/Project";
 import AIRunType from "../../../../Types/AI/AIRunType";
 import ObjectID from "../../../../Types/ObjectID";
 import PositiveNumber from "../../../../Types/PositiveNumber";
-import { afterEach, describe, expect, test } from "@jest/globals";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
 
 /*
  * Cost gates for autonomous INCIDENT investigations.
@@ -401,8 +402,8 @@ describe("AIIncidentInvestigationRunner.investigateNewIncident — gate wiring",
 
   test("a gated-out incident is never enqueued", async () => {
     jest
-      .spyOn(AIInvestigationEngine, "isEnabledForProject")
-      .mockResolvedValue(true);
+      .spyOn(AIInvestigationEngine, "getDisabledReason")
+      .mockResolvedValue(null);
     jest
       .spyOn(AIIncidentInvestigationRunner, "shouldInvestigateIncident")
       .mockResolvedValue({ investigate: false, reason: "below floor" });
@@ -420,8 +421,8 @@ describe("AIIncidentInvestigationRunner.investigateNewIncident — gate wiring",
 
   test("a passing incident is enqueued carrying its monitor as the dedupe key", async () => {
     jest
-      .spyOn(AIInvestigationEngine, "isEnabledForProject")
-      .mockResolvedValue(true);
+      .spyOn(AIInvestigationEngine, "getDisabledReason")
+      .mockResolvedValue(null);
     jest
       .spyOn(AIIncidentInvestigationRunner, "shouldInvestigateIncident")
       .mockResolvedValue({
@@ -449,8 +450,8 @@ describe("AIIncidentInvestigationRunner.investigateNewIncident — gate wiring",
   // The project opt-in is still checked before anything else costs a query.
   test("a project with investigations disabled never reaches the gate", async () => {
     jest
-      .spyOn(AIInvestigationEngine, "isEnabledForProject")
-      .mockResolvedValue(false);
+      .spyOn(AIInvestigationEngine, "getDisabledReason")
+      .mockResolvedValue("automatic_investigation_disabled");
     const gateSpy: jest.SpyInstance = jest.spyOn(
       AIIncidentInvestigationRunner,
       "shouldInvestigateIncident",
@@ -478,8 +479,8 @@ describe("AIIncidentInvestigationRunner.investigateNewIncident — gate wiring",
    */
   test("a throwing gate is swallowed, enqueues nothing, and reports not-enqueued", async () => {
     jest
-      .spyOn(AIInvestigationEngine, "isEnabledForProject")
-      .mockResolvedValue(true);
+      .spyOn(AIInvestigationEngine, "getDisabledReason")
+      .mockResolvedValue(null);
     jest
       .spyOn(AIIncidentInvestigationRunner, "shouldInvestigateIncident")
       .mockRejectedValue(new Error("database unavailable"));
@@ -498,3 +499,9 @@ describe("AIIncidentInvestigationRunner.investigateNewIncident — gate wiring",
     expect(enqueue).not.toHaveBeenCalled();
   });
 });
+
+beforeEach(() => {
+  jest
+    .spyOn(InvestigationEligibility, "recordSkipped")
+    .mockResolvedValue(undefined);
+});

package/Tests/Server/Utils/AI/AIRunPrivacyFilter.test.ts

@@ -16,12 +16,30 @@ import NotEqual from "../../../../Types/BaseDatabase/NotEqual";
 import NotNull from "../../../../Types/BaseDatabase/NotNull";
 import Search from "../../../../Types/BaseDatabase/Search";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil from "../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import Exception from "../../../../Types/Exception/Exception";
+import ExceptionCode from "../../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
 import ObjectID from "../../../../Types/ObjectID";
 import { UserTenantAccessPermission } from "../../../../Types/Permission";
+import UserType from "../../../../Types/UserType";
 import { describe, expect, test } from "@jest/globals";
 import { FindOperator } from "typeorm";
 
+// Runs `fn` and returns what it threw; fails the test if it returned.
+const thrownBy: (fn: () => unknown) => Exception = (
+  fn: () => unknown,
+): Exception => {
+  try {
+    fn();
+  } catch (error) {
+    return error as Exception;
+  }
+
+  throw new Error("Expected the call to throw, but it returned normally.");
+};
+
 /*
  * The forced privacy clause must survive every operator a client can smuggle
  * into query.runType. BaseAPI.getList takes `query` straight from the request
@@ -125,23 +143,97 @@ describe("getAIRunPrivacyRaw", () => {
    * project fix history — access neither /ai-run nor /code-fix-run grants.
    */
   test("rejects a caller with no user, even though CodeFix runs are shared", () => {
+    /*
+     * userType API is what ProjectAuthorization stamps on a key-authenticated
+     * request. Without it the props would read as anonymous (no credentials
+     * at all) and get the 401 below instead of this 422.
+     */
     const apiKeyShapedProps: DatabaseCommonInteractionProps = {
       tenantId: ObjectID.generate(),
+      userType: UserType.API,
       userTenantAccessPermission: {} as {
         [tenantId: string]: UserTenantAccessPermission;
       },
     };
 
-    expect(() => {
-      return getAIRunPrivacyRaw(apiKeyShapedProps);
-    }).toThrow(NotAuthorizedException);
-
-    expect(() => {
-      return applyAIRunPrivacyFilter(
-        { runType: AIRunType.CodeFix },
-        apiKeyShapedProps,
+    for (const error of [
+      thrownBy(() => {
+        return getAIRunPrivacyRaw(apiKeyShapedProps);
+      }),
+      thrownBy(() => {
+        return applyAIRunPrivacyFilter(
+          { runType: AIRunType.CodeFix },
+          apiKeyShapedProps,
+        );
+      }),
+    ]) {
+      expect(error).toBeInstanceOf(NotAuthorizedException);
+      expect(error).not.toBeInstanceOf(NotAuthenticatedException);
+      expect(error.code).toBe(ExceptionCode.NotAuthorizedException);
+      expect(error.code).toBe(422);
+      expect(error.message).toBe(
+        "AI runs are personal and can only be accessed by the user who created them.",
       );
-    }).toThrow(NotAuthorizedException);
+    }
+  });
+
+  /*
+   * No credentials at all is a signed-in user whose access-token cookie
+   * expired. The browser client refreshes the session and replays only on a
+   * 401, so this must not be the 422 an API key gets above.
+   */
+  test.each([
+    ["no props at all", {}],
+    [
+      "a tenant and tenant permissions but no user and no userType",
+      {
+        tenantId: ObjectID.generate(),
+        userTenantAccessPermission: {} as {
+          [tenantId: string]: UserTenantAccessPermission;
+        },
+      },
+    ],
+    [
+      "an explicitly Public caller",
+      { tenantId: ObjectID.generate(), userType: UserType.Public },
+    ],
+  ])(
+    "answers an anonymous caller (%s) with 401",
+    (_label: string, props: DatabaseCommonInteractionProps) => {
+      for (const error of [
+        thrownBy(() => {
+          return getAIRunPrivacyRaw(props);
+        }),
+        thrownBy(() => {
+          return applyAIRunPrivacyFilter({ runType: AIRunType.CodeFix }, props);
+        }),
+      ]) {
+        expect(error).toBeInstanceOf(NotAuthenticatedException);
+        expect(error).not.toBeInstanceOf(NotAuthorizedException);
+        expect(error.code).toBe(ExceptionCode.NotAuthenticatedException);
+        expect(error.code).toBe(401);
+        expect(error.message).toBe(
+          DatabaseCommonInteractionPropsUtil.AUTHENTICATION_REQUIRED_MESSAGE,
+        );
+      }
+    },
+  );
+
+  test("a signed-in user still gets the clause, not a refusal", () => {
+    const signedInUserId: ObjectID = ObjectID.generate();
+
+    const filtered: Record<string, unknown> = applyAIRunPrivacyFilter(
+      {},
+      { userId: signedInUserId, userType: UserType.User },
+    );
+
+    expect(filtered["runType"]).toBeInstanceOf(FindOperator);
+    expect(render(filtered["runType"])).toContain(`"AIRun"."userId"`);
+  });
+
+  test("root and master admin without a user are not refused", () => {
+    expect(applyAIRunPrivacyFilter({}, { isRoot: true })).toEqual({});
+    expect(applyAIRunPrivacyFilter({}, { isMasterAdmin: true })).toEqual({});
   });
 });