@oneuptime/common 13.0.6 → 13.0.8

package/Tests/Server/Utils/MasterAdminPageAccess.test.ts

@@ -0,0 +1,251 @@
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import { ExpressRequest, ExpressResponse } from "../../../Server/Utils/Express";
+import JSONWebToken from "../../../Server/Utils/JsonWebToken";
+import logger from "../../../Server/Utils/Logger";
+import {
+  ensureMasterAdminPageAccess,
+  NOT_A_MASTER_ADMIN_MESSAGE,
+} from "../../../Server/Utils/MasterAdminPageAccess";
+import Response from "../../../Server/Utils/Response";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import { JSONObject } from "../../../Types/JSON";
+import JSONWebTokenData from "../../../Types/JsonWebTokenData";
+import ObjectID from "../../../Types/ObjectID";
+import { getJestSpyOn } from "../../Spy";
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+
+// The decode-failure branch logs at debug; keep the run quiet and observable.
+jest.mock("../../../Server/Utils/Logger");
+
+/*
+ * ensureMasterAdminPageAccess gates the Admin Dashboard's HTML shell (not its
+ * APIs), and replaced two copies of the same inline gate in
+ * App/FeatureSet/Frontend/Index.ts and App/FeatureSet/AdminDashboard/Serve.ts.
+ *
+ * The case it exists for: the access-token cookie expires together with the
+ * JWT inside it. An admin who reloads a tab left open past the token lifetime
+ * arrives with NO token at all. The old gates answered that with a 422 JSON
+ * error page, so the SPA never loaded and never got the chance to refresh the
+ * session - the admin was stuck until they found the login page by hand. Now
+ * a missing or undecodable token is served the shell (it holds nothing the
+ * public static bundle does not), and the SPA's refresh-aware API client
+ * recovers the session or sends a signed-out visitor to the login page.
+ *
+ * The one refusal that did NOT move: a session that decodes and is positively
+ * not a master admin still gets the error. Refreshing would hand back the
+ * same non-admin session.
+ */
+
+const SERVICE: string = "admin-dashboard-test";
+
+describe("ensureMasterAdminPageAccess", () => {
+  let request: ExpressRequest;
+  let response: ExpressResponse;
+  let getAccessTokenSpy: jest.SpyInstance<any, any>;
+  let decodeSpy: jest.SpyInstance<any, any>;
+  let sendErrorSpy: jest.SpyInstance<any, any>;
+
+  type RunFunction = () => Promise<JSONObject>;
+
+  const run: RunFunction = async (): Promise<JSONObject> => {
+    return await ensureMasterAdminPageAccess({
+      req: request,
+      res: response,
+      service: SERVICE,
+    });
+  };
+
+  type DecodedTokenFunction = (isMasterAdmin: unknown) => JSONWebTokenData;
+
+  const decodedToken: DecodedTokenFunction = (
+    isMasterAdmin: unknown,
+  ): JSONWebTokenData => {
+    return {
+      userId: ObjectID.generate(),
+      isMasterAdmin: isMasterAdmin,
+      isGlobalLogin: true,
+    } as unknown as JSONWebTokenData;
+  };
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    jest.clearAllMocks();
+
+    request = { headers: {}, cookies: {} } as unknown as ExpressRequest;
+
+    response = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+      send: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+
+    getAccessTokenSpy = getJestSpyOn(
+      UserMiddleware,
+      "getAccessTokenFromExpressRequest",
+    ).mockReturnValue(undefined);
+
+    /*
+     * Each test that needs a decodable token says what it decodes to. The
+     * default is the real failure: JSONWebToken.decode wraps every jwt.verify
+     * error (expired, bad signature, malformed) in this BadDataException.
+     */
+    decodeSpy = getJestSpyOn(JSONWebToken, "decode").mockImplementation(() => {
+      throw new BadDataException("AccessToken is invalid or expired");
+    });
+
+    sendErrorSpy = getJestSpyOn(
+      Response,
+      "sendErrorResponse",
+    ).mockImplementation(() => {
+      return undefined as never;
+    });
+  });
+
+  describe("with no access token (the expired-cookie reload)", () => {
+    test("resolves to an empty object and sends no error, so the SPA loads", async () => {
+      await expect(run()).resolves.toEqual({});
+
+      expect(sendErrorSpy).not.toHaveBeenCalled();
+      expect(response.status).not.toHaveBeenCalled();
+      expect(response.send).not.toHaveBeenCalled();
+      expect(response.json).not.toHaveBeenCalled();
+    });
+
+    test("reads the token from the request it was given", async () => {
+      await run();
+
+      expect(getAccessTokenSpy).toHaveBeenCalledTimes(1);
+      expect(getAccessTokenSpy).toHaveBeenCalledWith(request);
+    });
+
+    test("never tries to decode a token it does not have", async () => {
+      await run();
+
+      expect(decodeSpy).not.toHaveBeenCalled();
+    });
+
+    test("treats an empty-string token as no token", async () => {
+      getAccessTokenSpy.mockReturnValue("");
+
+      await expect(run()).resolves.toEqual({});
+
+      expect(decodeSpy).not.toHaveBeenCalled();
+      expect(sendErrorSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("with a token that does not decode", () => {
+    beforeEach(() => {
+      getAccessTokenSpy.mockReturnValue("expired.jwt.token");
+    });
+
+    test("resolves to an empty object and sends no error", async () => {
+      await expect(run()).resolves.toEqual({});
+
+      expect(decodeSpy).toHaveBeenCalledTimes(1);
+      expect(decodeSpy).toHaveBeenCalledWith("expired.jwt.token");
+      expect(sendErrorSpy).not.toHaveBeenCalled();
+      expect(response.status).not.toHaveBeenCalled();
+    });
+
+    // Whatever decode throws, the shell is served and nothing escapes.
+    test.each([
+      [
+        "the BadDataException JSONWebToken.decode raises",
+        (): Error => {
+          return new BadDataException("AccessToken is invalid or expired");
+        },
+      ],
+      [
+        "a plain Error",
+        (): Error => {
+          return new Error("jwt expired");
+        },
+      ],
+      [
+        "a NotAuthorizedException",
+        (): Error => {
+          return new NotAuthorizedException("should not surface");
+        },
+      ],
+    ])(
+      "does not reject or send an error when decode throws %s",
+      async (_label: string, makeError: () => Error) => {
+        decodeSpy.mockImplementation(() => {
+          throw makeError();
+        });
+
+        await expect(run()).resolves.toEqual({});
+
+        expect(sendErrorSpy).not.toHaveBeenCalled();
+      },
+    );
+
+    test("logs the decode failure at debug, tagged with the service", async () => {
+      const thrown: Error = new Error("jwt expired");
+
+      decodeSpy.mockImplementation(() => {
+        throw thrown;
+      });
+
+      await run();
+
+      expect(logger.debug).toHaveBeenCalledWith(thrown, { service: SERVICE });
+    });
+  });
+
+  describe("with a token that decodes", () => {
+    beforeEach(() => {
+      getAccessTokenSpy.mockReturnValue("valid.jwt.token");
+    });
+
+    test("refuses a session that is not a master admin with a 422", async () => {
+      decodeSpy.mockReturnValue(decodedToken(false) as never);
+
+      await expect(run()).resolves.toEqual({});
+
+      expect(sendErrorSpy).toHaveBeenCalledTimes(1);
+
+      const [sentRequest, sentResponse, sentError] = sendErrorSpy.mock
+        .calls[0] as [ExpressRequest, ExpressResponse, Exception];
+
+      expect(sentRequest).toBe(request);
+      expect(sentResponse).toBe(response);
+      expect(sentError).toBeInstanceOf(NotAuthorizedException);
+      expect(sentError).not.toBeInstanceOf(NotAuthenticatedException);
+      expect(sentError.code).toBe(422);
+      expect(sentError.message).toBe(NOT_A_MASTER_ADMIN_MESSAGE);
+    });
+
+    test("refuses a token with no isMasterAdmin claim at all", async () => {
+      decodeSpy.mockReturnValue(decodedToken(undefined) as never);
+
+      await run();
+
+      expect(sendErrorSpy).toHaveBeenCalledTimes(1);
+      expect(
+        (sendErrorSpy.mock.calls[0] as Array<unknown>)[2] as Exception,
+      ).toBeInstanceOf(NotAuthorizedException);
+    });
+
+    test("lets a master admin through without sending anything", async () => {
+      decodeSpy.mockReturnValue(decodedToken(true) as never);
+
+      await expect(run()).resolves.toEqual({});
+
+      expect(decodeSpy).toHaveBeenCalledWith("valid.jwt.token");
+      expect(sendErrorSpy).not.toHaveBeenCalled();
+      expect(response.status).not.toHaveBeenCalled();
+      expect(response.send).not.toHaveBeenCalled();
+    });
+  });
+
+  test("the refusal message names the admin dashboard", () => {
+    expect(NOT_A_MASTER_ADMIN_MESSAGE).toBe(
+      "Unauthorized: Only master admins can access the admin dashboard.",
+    );
+  });
+});

package/Tests/Server/Utils/Monitor/Criteria/APIRequestCriteriaEvaluateOverTime.test.ts

@@ -171,10 +171,9 @@ describe("APIRequestCriteria evaluate over time", () => {
         dataToProcess: buildResponse({ responseCode: 404 }),
       });
 
-      expect(result).toContain("All values of");
-      expect(result).toContain(CheckOn.ResponseStatusCode as string);
-      expect(result).toContain("over the last 5 minutes");
-      expect(result).toContain("not equal to 200");
+      expect(result).toBe(
+        `${CheckOn.ResponseStatusCode} over the last 5 minutes was 404 in all 5 readings, different from the 200 threshold.`,
+      );
     });
 
     /*
@@ -229,8 +228,9 @@ describe("APIRequestCriteria evaluate over time", () => {
         dataToProcess: buildResponse({ responseTimeInMs: 8800 }),
       });
 
-      expect(result).toContain("All values of");
-      expect(result).toContain("greater than 8000");
+      expect(result).toBe(
+        `${CheckOn.ResponseTime} over the last 2 minutes ranged from 8800 to 9171 across all 3 readings, above the 8000 threshold.`,
+      );
     });
 
     /*
@@ -251,7 +251,9 @@ describe("APIRequestCriteria evaluate over time", () => {
         dataToProcess: buildResponse({ responseTimeInMs: 9171 }),
       });
 
-      expect(result).toContain("Any value of");
+      expect(result).toBe(
+        `${CheckOn.ResponseTime} over the last 2 minutes was 9171 in 1 of 3 readings, above the 8000 threshold.`,
+      );
     });
 
     test("Any Value fires off the very first sample", async () => {
@@ -371,7 +373,7 @@ describe("APIRequestCriteria evaluate over time", () => {
       });
 
       // 0 is not equal to 200, so the filter is met.
-      expect(result).toContain("not equal to 200");
+      expect(result).toContain("different from the 200 threshold");
     });
   });
 
@@ -456,7 +458,7 @@ describe("APIRequestCriteria evaluate over time", () => {
         dataToProcess: buildResponse({ responseCode: 404 }),
       });
 
-      expect(result).toContain("not equal to 200");
+      expect(result).toContain("different from the 200 threshold");
     });
 
     test("the metric store is never read for them", async () => {

package/Tests/Server/Utils/Monitor/Criteria/CompareCriteria.test.ts

@@ -580,7 +580,7 @@ describe("CompareCriteria", () => {
           threshold: 50,
           criteriaFilter: filter,
         }),
-      ).toBe("Response Time (in ms) is 100 which is greater than 50.");
+      ).toBe("Response Time (in ms) was 100, above the 50 threshold.");
     });
 
     test("does not fire when the threshold is not breached", () => {
@@ -677,7 +677,7 @@ describe("CompareCriteria", () => {
   });
 
   describe("getCompareMessage formatting", () => {
-    test("prefixes 'Any value of' / 'All values of' for over-time evaluation", () => {
+    test("summarizes the readings when AnyValue and AllValues both match the whole window", () => {
       const anyFilter: CriteriaFilter = makeFilter({
         checkOn: CheckOn.ResponseTime,
         filterType: FilterType.GreaterThan,
@@ -693,7 +693,7 @@ describe("CompareCriteria", () => {
           criteriaFilter: anyFilter,
         }),
       ).toBe(
-        "Any value of Response Time (in ms) is 10, 20 which is greater than 5.",
+        "Response Time (in ms) ranged from 10 to 20 across all 2 readings, above the 5 threshold.",
       );
 
       const allFilter: CriteriaFilter = makeFilter({
@@ -711,7 +711,7 @@ describe("CompareCriteria", () => {
           criteriaFilter: allFilter,
         }),
       ).toBe(
-        "All values of Response Time (in ms) is 10, 20 which is greater than 5.",
+        "Response Time (in ms) ranged from 10 to 20 across all 2 readings, above the 5 threshold.",
       );
     });
 
@@ -727,7 +727,7 @@ describe("CompareCriteria", () => {
           criteriaFilter: filter,
         }),
       ).toBe(
-        "Response Time (in ms) is 6 samples between 1 and 6 which is greater than 0.",
+        "Response Time (in ms) ranged from 1 to 6 across all 6 readings, above the 0 threshold.",
       );
     });
 
@@ -756,7 +756,7 @@ describe("CompareCriteria", () => {
           threshold: 1.9999,
           criteriaFilter: filter,
         }),
-      ).toBe("Response Time (in ms) is 12.35 which is greater than 2.");
+      ).toBe("Response Time (in ms) was 12.35, above the 2 threshold.");
     });
 
     test("appends a unit suffix to both the value and the threshold", () => {
@@ -771,7 +771,7 @@ describe("CompareCriteria", () => {
           criteriaFilter: filter,
           unit: "ms",
         }),
-      ).toBe("Metric Value is 100 ms which is greater than 50 ms.");
+      ).toBe("Metric Value was 100 ms, above the 50 ms threshold.");
     });
 
     /*
@@ -798,7 +798,7 @@ describe("CompareCriteria", () => {
           criteriaFilter: filter,
           unit: "By",
         }),
-      ).toBe("Metric Value is 1.07 GB which is greater than 1 GB.");
+      ).toBe("Metric Value was 1.07 GB, above the 1 GB threshold.");
     });
 
     test("rescales a duration", () => {
@@ -813,10 +813,10 @@ describe("CompareCriteria", () => {
           criteriaFilter: filter,
           unit: "ms",
         }),
-      ).toBe("Metric Value is 1.5 sec which is greater than 1 sec.");
+      ).toBe("Metric Value was 1.5 sec, above the 1 sec threshold.");
     });
 
-    test("gives every listed sample its own scale", () => {
+    test("gives each end of a range its own scale", () => {
       const filter: CriteriaFilter = makeFilter({
         checkOn: CheckOn.MetricValue,
         filterType: FilterType.GreaterThan,
@@ -834,11 +834,11 @@ describe("CompareCriteria", () => {
           unit: "By",
         }),
       ).toBe(
-        "All values of Metric Value over the last 5 minutes is 922 KB, 1.26 MB which is greater than 900 KB.",
+        "Metric Value over the last 5 minutes ranged from 922 KB to 1.26 MB across all 2 readings, above the 900 KB threshold.",
       );
     });
 
-    test("units ride both ends of the 'N samples between X and Y' summary", () => {
+    test("units ride both ends of a range summary", () => {
       const filter: CriteriaFilter = makeFilter({
         checkOn: CheckOn.MetricValue,
         filterType: FilterType.GreaterThan,
@@ -854,8 +854,10 @@ describe("CompareCriteria", () => {
         unit: "By",
       });
 
-      expect(message).toContain("6 samples between 1 GB and 6 GB");
-      expect(message).toContain("greater than 500 MB");
+      expect(message).toContain(
+        "ranged from 1 GB to 6 GB across all 6 readings",
+      );
+      expect(message).toContain("above the 500 MB threshold");
     });
 
     /*
@@ -877,7 +879,7 @@ describe("CompareCriteria", () => {
       });
 
       expect(message).toBe(
-        "browser.cumulative_layout_shift is 0.31 which is greater than or equal to 0.25.",
+        "browser.cumulative_layout_shift was 0.31, at or above the 0.25 threshold.",
       );
       expect(message).not.toContain("0.31 1");
     });
@@ -897,7 +899,7 @@ describe("CompareCriteria", () => {
       });
 
       expect(message).toBe(
-        "system.cpu.utilization is 5.85% which is greater than 5.00%.",
+        "system.cpu.utilization was 5.85%, above the 5.00% threshold.",
       );
     });
 
@@ -913,7 +915,7 @@ describe("CompareCriteria", () => {
         unit: "{thread}",
       });
 
-      expect(message).toBe("Metric Value is 512 which is greater than 500.");
+      expect(message).toBe("Metric Value was 512, above the 500 threshold.");
       expect(message).not.toContain("{thread}");
     });
 
@@ -938,7 +940,7 @@ describe("CompareCriteria", () => {
         unit: "1",
       });
 
-      expect(message).toBe("a / b_ratio is 0.42 which is greater than 0.4.");
+      expect(message).toBe("a / b_ratio was 0.42, above the 0.4 threshold.");
       expect(message).not.toContain("42.00%");
     });
 
@@ -946,16 +948,16 @@ describe("CompareCriteria", () => {
      * BACKWARD COMPATIBILITY. Only MetricMonitorCriteria and
      * DatabaseMonitorCriteria pass a unit; every other monitor type
      * carries its unit inside the CheckOn label ("Response Time (in ms)")
-     * and must keep byte-identical, unabbreviated output.
+     * and must keep its numbers unabbreviated.
      */
-    test("a message with no unit is unchanged, digits and all", () => {
+    test("a message with no unit preserves its original numeric scale", () => {
       const filter: CriteriaFilter = makeFilter({
         checkOn: CheckOn.ResponseTime,
         filterType: FilterType.GreaterThan,
       });
 
       const expected: string =
-        "Response Time (in ms) is 5000 which is greater than 4900.";
+        "Response Time (in ms) was 5000, above the 4900 threshold.";
 
       expect(
         CompareCriteria.getCompareMessage({
@@ -1028,7 +1030,7 @@ describe("CompareCriteria", () => {
           threshold: 80,
           criteriaFilter: withPath,
         }),
-      ).toBe("Disk Usage (in %) on disk /var is 95 which is greater than 80.");
+      ).toBe("Disk Usage (in %) on disk /var was 95, above the 80 threshold.");
 
       const withoutPath: CriteriaFilter = makeFilter({
         checkOn: CheckOn.DiskUsagePercent,
@@ -1074,7 +1076,7 @@ describe("CompareCriteria", () => {
           criteriaFilter: metricFilter,
           metricDisplayName: "http.server.duration",
         }),
-      ).toBe("http.server.duration is 100 which is greater than 50.");
+      ).toBe("http.server.duration was 100, above the 50 threshold.");
 
       // For a non-MetricValue check the display name is ignored.
       const responseFilter: CriteriaFilter = makeFilter({
@@ -1088,7 +1090,7 @@ describe("CompareCriteria", () => {
           criteriaFilter: responseFilter,
           metricDisplayName: "http.server.duration",
         }),
-      ).toBe("Response Time (in ms) is 100 which is greater than 50.");
+      ).toBe("Response Time (in ms) was 100, above the 50 threshold.");
     });
 
     test("True/False messages omit the 'which is' clause", () => {
@@ -1105,35 +1107,50 @@ describe("CompareCriteria", () => {
       ).toBe("Is Online is true.");
     });
 
-    test("renders each comparison verb", () => {
-      const verbs: Array<{ filterType: FilterType; verb: string }> = [
-        { filterType: FilterType.GreaterThan, verb: "greater than" },
-        {
-          filterType: FilterType.GreaterThanOrEqualTo,
-          verb: "greater than or equal to",
-        },
-        { filterType: FilterType.LessThan, verb: "less than" },
-        {
-          filterType: FilterType.LessThanOrEqualTo,
-          verb: "less than or equal to",
-        },
-        { filterType: FilterType.EqualTo, verb: "equal to" },
-        { filterType: FilterType.NotEqualTo, verb: "not equal to" },
-      ];
-
-      for (const { filterType, verb } of verbs) {
+    test.each([
+      { filterType: FilterType.GreaterThan, value: 100, relation: "above" },
+      {
+        filterType: FilterType.GreaterThanOrEqualTo,
+        value: 50,
+        relation: "at or above",
+      },
+      { filterType: FilterType.LessThan, value: 25, relation: "below" },
+      {
+        filterType: FilterType.LessThanOrEqualTo,
+        value: 50,
+        relation: "at or below",
+      },
+      { filterType: FilterType.EqualTo, value: 50, relation: "equal to" },
+      {
+        filterType: FilterType.NotEqualTo,
+        value: 100,
+        relation: "different from",
+      },
+    ])(
+      "renders $filterType as $relation",
+      ({
+        filterType,
+        value,
+        relation,
+      }: {
+        filterType: FilterType;
+        value: number;
+        relation: string;
+      }) => {
         const filter: CriteriaFilter = makeFilter({
           checkOn: CheckOn.ResponseTime,
           filterType,
         });
         expect(
           CompareCriteria.getCompareMessage({
-            values: 100,
+            values: value,
             threshold: 50,
             criteriaFilter: filter,
           }),
-        ).toContain(verb);
-      }
-    });
+        ).toBe(
+          `Response Time (in ms) was ${value}, ${relation} the 50 threshold.`,
+        );
+      },
+    );
   });
 });