@oneuptime/common 13.0.6 → 13.0.8

package/Tests/Server/Utils/Rules/OwnerRuleAssignment.test.ts

@@ -1,20 +1,24 @@
 import MonitorOwnerTeam from "../../../../Models/DatabaseModels/MonitorOwnerTeam";
 import MonitorOwnerUser from "../../../../Models/DatabaseModels/MonitorOwnerUser";
+import BadDataException from "../../../../Types/Exception/BadDataException";
 import ObjectID from "../../../../Types/ObjectID";
 import DatabaseService from "../../../../Server/Services/DatabaseService";
 import OwnerRuleAssignment, {
   OwnersToAssign,
 } from "../../../../Server/Utils/Rules/OwnerRuleAssignment";
+import PostgresErrorTranslator from "../../../../Server/Utils/Database/PostgresErrorTranslator";
 import { describe, expect, it } from "@jest/globals";
 
 /*
  * Contract under test - owner rules never create a second owner row for a user
  * or team that already owns the resource.
  *
- * Owner rows have no unique constraint, so a duplicate is not an error: it is
- * an owner listed twice and notified twice. A rule run meets existing owners
- * on nearly every resource it touches, which is why this filter sits in front
- * of every owner rule engine.
+ * A duplicate owner is an owner listed twice and notified twice. Owner rows
+ * are unique now (issue #3394), so a duplicate insert is refused rather than
+ * stored - but a refused insert is an error, and a rule run meets existing
+ * owners on nearly every resource it touches. That is why this filter sits in
+ * front of every owner rule engine, and why the inserts that follow it treat
+ * "already an owner" as done rather than as a failure.
  */
 
 const MONITOR_ID: ObjectID = new ObjectID(
@@ -175,3 +179,407 @@ describe("OwnerRuleAssignment.getOwnersNotYetAssigned", () => {
     expect(ids(result.userIds)).toEqual([USER_A.toString(), USER_B.toString()]);
   });
 });
+
+/*
+ * What an owner service's create() throws for an owner who is already there,
+ * in each of the two forms it can take.
+ */
+function refusedByServiceCheck(): Error {
+  return PostgresErrorTranslator.createUniqueViolationException(
+    "This team is already an owner of this monitor.",
+  );
+}
+
+function refusedByUniqueIndex(): unknown {
+  // A QueryFailedError as pg reports it, before DatabaseService translates it.
+  return {
+    code: "23505",
+    table: "MonitorOwnerTeam",
+    detail:
+      'Key ("monitorId", "teamId", "projectId")=(c, b, a) already exists.',
+  };
+}
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "99999999-9999-4999-8999-999999999999",
+);
+const CREATED_BY: ObjectID = new ObjectID(
+  "55555555-5555-4555-8555-555555555555",
+);
+
+interface WritableServices extends FakeServices {
+  createUser: jest.Mock;
+  createTeam: jest.Mock;
+}
+
+function writableServices(data: {
+  existingUsers?: Array<MonitorOwnerUser>;
+  existingTeams?: Array<MonitorOwnerTeam>;
+  // Thrown by create() for these owner ids, keyed by id string.
+  userErrors?: Record<string, unknown>;
+  teamErrors?: Record<string, unknown>;
+}): WritableServices {
+  const services: FakeServices = fakeServices(data);
+
+  const createUser: jest.Mock = jest.fn(
+    async (args: { data: MonitorOwnerUser }) => {
+      const error: unknown = data.userErrors?.[args.data.userId!.toString()];
+      if (error) {
+        throw error;
+      }
+      return args.data;
+    },
+  );
+  const createTeam: jest.Mock = jest.fn(
+    async (args: { data: MonitorOwnerTeam }) => {
+      const error: unknown = data.teamErrors?.[args.data.teamId!.toString()];
+      if (error) {
+        throw error;
+      }
+      return args.data;
+    },
+  );
+
+  Object.assign(services.ownerUserService, {
+    create: createUser,
+    modelType: MonitorOwnerUser,
+  });
+  Object.assign(services.ownerTeamService, {
+    create: createTeam,
+    modelType: MonitorOwnerTeam,
+  });
+
+  return { ...services, createUser, createTeam };
+}
+
+function writtenRows<T>(create: jest.Mock): Array<T> {
+  return create.mock.calls.map((call: Array<unknown>): T => {
+    return (call[0] as { data: T }).data;
+  });
+}
+
+describe("OwnerRuleAssignment.createOwner", () => {
+  function serviceThat(create: jest.Mock): DatabaseService<MonitorOwnerTeam> {
+    return { create } as unknown as DatabaseService<MonitorOwnerTeam>;
+  }
+
+  it("resolves true when the row is written, passing data and props through", async () => {
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+    const owner: MonitorOwnerTeam = ownerTeam(TEAM_A);
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: serviceThat(create),
+        owner: owner,
+        props: { isRoot: true },
+      }),
+    ).resolves.toBe(true);
+
+    expect(create).toHaveBeenCalledWith({
+      data: owner,
+      props: { isRoot: true },
+    });
+  });
+
+  it("resolves false when the service's own check finds the owner", async () => {
+    const create: jest.Mock = jest.fn(async () => {
+      throw refusedByServiceCheck();
+    });
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: serviceThat(create),
+        owner: ownerTeam(TEAM_A),
+        props: { isRoot: true },
+      }),
+    ).resolves.toBe(false);
+  });
+
+  it("resolves false when the unique index turns away a racing insert", async () => {
+    const create: jest.Mock = jest.fn(async () => {
+      throw refusedByUniqueIndex();
+    });
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: serviceThat(create),
+        owner: ownerTeam(TEAM_A),
+        props: { isRoot: true },
+      }),
+    ).resolves.toBe(false);
+  });
+
+  it("resolves false for a unique violation DatabaseService already translated", async () => {
+    const create: jest.Mock = jest.fn(async () => {
+      throw PostgresErrorTranslator.translate(refusedByUniqueIndex());
+    });
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: serviceThat(create),
+        owner: ownerTeam(TEAM_A),
+        props: { isRoot: true },
+      }),
+    ).resolves.toBe(false);
+  });
+
+  it.each([
+    ["a generic error", new Error("connection reset")],
+    ["a plain validation failure", new BadDataException("teamId is required")],
+    [
+      "a foreign key violation",
+      {
+        code: "23503",
+        detail: 'Key (teamId)=(x) is not present in table "Team".',
+      },
+    ],
+  ])("rethrows %s", async (_label: string, failure: unknown) => {
+    const create: jest.Mock = jest.fn(async () => {
+      throw failure;
+    });
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: serviceThat(create),
+        owner: ownerTeam(TEAM_A),
+        props: { isRoot: true },
+      }),
+    ).rejects.toBe(failure);
+  });
+});
+
+describe("OwnerRuleAssignment.addOwners", () => {
+  function add(
+    services: WritableServices,
+    overrides: Partial<{
+      userIds: Array<ObjectID | string>;
+      teamIds: Array<ObjectID | string>;
+      isOwnerNotified: boolean | undefined;
+      createdByUserId: ObjectID | undefined;
+    }> = {},
+  ): Promise<OwnersToAssign> {
+    return OwnerRuleAssignment.addOwners({
+      ownerUserService: services.ownerUserService,
+      ownerTeamService: services.ownerTeamService,
+      resourceIdColumn: "monitorId",
+      resourceId: MONITOR_ID,
+      projectId: PROJECT_ID,
+      userIds: [],
+      teamIds: [],
+      props: { isRoot: true },
+      ...overrides,
+    });
+  }
+
+  it("writes one row per owner, on the resource and in the project", async () => {
+    const services: WritableServices = writableServices({});
+
+    await add(services, {
+      userIds: [USER_A],
+      teamIds: [TEAM_A],
+      isOwnerNotified: false,
+    });
+
+    const userRow: MonitorOwnerUser | undefined = writtenRows<MonitorOwnerUser>(
+      services.createUser,
+    )[0];
+    const teamRow: MonitorOwnerTeam | undefined = writtenRows<MonitorOwnerTeam>(
+      services.createTeam,
+    )[0];
+
+    expect(userRow).toBeInstanceOf(MonitorOwnerUser);
+    expect(userRow!.monitorId!.toString()).toBe(MONITOR_ID.toString());
+    expect(userRow!.projectId!.toString()).toBe(PROJECT_ID.toString());
+    expect(userRow!.userId!.toString()).toBe(USER_A.toString());
+    expect(userRow!.isOwnerNotified).toBe(false);
+
+    expect(teamRow).toBeInstanceOf(MonitorOwnerTeam);
+    expect(teamRow!.monitorId!.toString()).toBe(MONITOR_ID.toString());
+    expect(teamRow!.projectId!.toString()).toBe(PROJECT_ID.toString());
+    expect(teamRow!.teamId!.toString()).toBe(TEAM_A.toString());
+    expect(teamRow!.isOwnerNotified).toBe(false);
+  });
+
+  it("skips owners the resource already has", async () => {
+    const services: WritableServices = writableServices({
+      existingUsers: [ownerUser(USER_A)],
+      existingTeams: [ownerTeam(TEAM_A)],
+    });
+
+    const added: OwnersToAssign = await add(services, {
+      userIds: [USER_A, USER_B],
+      teamIds: [TEAM_A, TEAM_B],
+    });
+
+    expect(
+      writtenRows<MonitorOwnerUser>(services.createUser).map(
+        (r: MonitorOwnerUser): string => {
+          return r.userId!.toString();
+        },
+      ),
+    ).toEqual([USER_B.toString()]);
+    expect(
+      writtenRows<MonitorOwnerTeam>(services.createTeam).map(
+        (r: MonitorOwnerTeam): string => {
+          return r.teamId!.toString();
+        },
+      ),
+    ).toEqual([TEAM_B.toString()]);
+
+    expect(ids(added.userIds)).toEqual([USER_B.toString()]);
+    expect(ids(added.teamIds)).toEqual([TEAM_B.toString()]);
+  });
+
+  it("adds a team listed twice once (a criteria template that repeats a team)", async () => {
+    const services: WritableServices = writableServices({});
+
+    await add(services, {
+      teamIds: [TEAM_A, TEAM_A.toString(), TEAM_A],
+      userIds: [USER_A, USER_A],
+    });
+
+    expect(services.createTeam).toHaveBeenCalledTimes(1);
+    expect(services.createUser).toHaveBeenCalledTimes(1);
+  });
+
+  it("accepts ids that arrive as strings, and writes them as ids", async () => {
+    const services: WritableServices = writableServices({});
+
+    await add(services, {
+      teamIds: [TEAM_A.toString()],
+      userIds: [USER_A.toString()],
+    });
+
+    expect(
+      writtenRows<MonitorOwnerTeam>(services.createTeam)[0]!.teamId,
+    ).toBeInstanceOf(ObjectID);
+    expect(
+      writtenRows<MonitorOwnerUser>(services.createUser)[0]!.userId,
+    ).toBeInstanceOf(ObjectID);
+  });
+
+  it("keeps going past an owner another writer added a moment ago", async () => {
+    const services: WritableServices = writableServices({
+      teamErrors: { [TEAM_A.toString()]: refusedByUniqueIndex() },
+      userErrors: { [USER_A.toString()]: refusedByServiceCheck() },
+    });
+
+    const added: OwnersToAssign = await add(services, {
+      teamIds: [TEAM_A, TEAM_B],
+      userIds: [USER_A, USER_B],
+    });
+
+    // The raced owners were attempted, the rest still added...
+    expect(services.createTeam).toHaveBeenCalledTimes(2);
+    expect(services.createUser).toHaveBeenCalledTimes(2);
+
+    // ...and only what this call wrote is reported as added.
+    expect(ids(added.teamIds)).toEqual([TEAM_B.toString()]);
+    expect(ids(added.userIds)).toEqual([USER_B.toString()]);
+  });
+
+  it("stops on a failure that is not a duplicate", async () => {
+    const failure: Error = new Error("team was deleted");
+    const services: WritableServices = writableServices({
+      teamErrors: { [TEAM_A.toString()]: failure },
+    });
+
+    await expect(
+      add(services, { teamIds: [TEAM_A, TEAM_B], userIds: [USER_A] }),
+    ).rejects.toBe(failure);
+
+    expect(services.createUser).not.toHaveBeenCalled();
+  });
+
+  it("writes a fresh row for every owner", async () => {
+    const services: WritableServices = writableServices({});
+
+    await add(services, { teamIds: [TEAM_A, TEAM_B] });
+
+    const rows: Array<MonitorOwnerTeam> = writtenRows<MonitorOwnerTeam>(
+      services.createTeam,
+    );
+
+    expect(rows).toHaveLength(2);
+    expect(rows[0]).not.toBe(rows[1]);
+    expect(rows[0]!.teamId!.toString()).toBe(TEAM_A.toString());
+    expect(rows[1]!.teamId!.toString()).toBe(TEAM_B.toString());
+  });
+
+  it.each([
+    [true, true],
+    [false, false],
+  ])(
+    "writes isOwnerNotified = %p when asked to",
+    async (isOwnerNotified: boolean, expected: boolean) => {
+      const services: WritableServices = writableServices({});
+
+      await add(services, { teamIds: [TEAM_A], isOwnerNotified });
+
+      expect(
+        writtenRows<MonitorOwnerTeam>(services.createTeam)[0]!.isOwnerNotified,
+      ).toBe(expected);
+    },
+  );
+
+  it("leaves isOwnerNotified to the column default when not given", async () => {
+    const services: WritableServices = writableServices({});
+
+    await add(services, { teamIds: [TEAM_A] });
+
+    expect(
+      writtenRows<MonitorOwnerTeam>(services.createTeam)[0]!.isOwnerNotified,
+    ).toBeUndefined();
+  });
+
+  it("records who added the owners when told", async () => {
+    const services: WritableServices = writableServices({});
+
+    await add(services, {
+      teamIds: [TEAM_A],
+      userIds: [USER_A],
+      createdByUserId: CREATED_BY,
+    });
+
+    expect(
+      writtenRows<MonitorOwnerTeam>(services.createTeam)[0]!.createdByUserId,
+    ).toBe(CREATED_BY);
+    expect(
+      writtenRows<MonitorOwnerUser>(services.createUser)[0]!.createdByUserId,
+    ).toBe(CREATED_BY);
+  });
+
+  it("passes the caller's props to every write", async () => {
+    const services: WritableServices = writableServices({});
+    const props: { tenantId: ObjectID; userId: ObjectID } = {
+      tenantId: PROJECT_ID,
+      userId: CREATED_BY,
+    };
+
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: services.ownerUserService,
+      ownerTeamService: services.ownerTeamService,
+      resourceIdColumn: "monitorId",
+      resourceId: MONITOR_ID,
+      projectId: PROJECT_ID,
+      userIds: [USER_A],
+      teamIds: [TEAM_A],
+      props: props,
+    });
+
+    expect(services.createUser.mock.calls[0]![0]).toMatchObject({ props });
+    expect(services.createTeam.mock.calls[0]![0]).toMatchObject({ props });
+  });
+
+  it("writes nothing and reports nothing for an empty owner set", async () => {
+    const services: WritableServices = writableServices({});
+
+    const added: OwnersToAssign = await add(services);
+
+    expect(services.createTeam).not.toHaveBeenCalled();
+    expect(services.createUser).not.toHaveBeenCalled();
+    expect(added).toEqual({ userIds: [], teamIds: [] });
+  });
+});

package/Tests/Server/Utils/SecurityEvent/Connectors/GoogleSecOps/GoogleSecOpsConnectorSeverity.test.ts

@@ -0,0 +1,216 @@
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+import {
+  ConnectorFetchResult,
+  ConnectorFetchWindow,
+} from "../../../../../../Server/Utils/SecurityEvent/Connectors/Types";
+import { JSONObject } from "../../../../../../Types/JSON";
+import { SecurityConnectorSample } from "../../../../../../Types/SecurityEvent/Connectors/ConnectorDiagnostics";
+import NormalizedSecurityEvent from "../../../../../../Types/SecurityEvent/NormalizedSecurityEvent";
+import OcsfSeverity, {
+  OcsfSeverityId,
+} from "../../../../../../Types/SecurityEvent/OcsfSeverity";
+import {
+  FIXTURE_CURATED_RULE_ID,
+  FakeClient,
+  connectorWith,
+  fetchOptions,
+  fetched,
+  makeFakeClient,
+  page,
+  secOpsSettings,
+} from "./GoogleSecOpsConnectorFixtures";
+
+/*
+ * The severity a Google SecOps poll imports, end to end through the real
+ * connector: its rule, curated and alerts-view passes feed Google's raw
+ * Collections to the normalizer, and the events and samples come back
+ * graded.
+ *
+ * A custom YARA-L rule carries its severity only in the rule's meta labels
+ * (detection[].ruleLabels); a curated rule carries the one Google gave it
+ * (detection[].severity). Before the fix a poll that read both imported the
+ * curated detections graded and every custom-rule detection as Unknown.
+ */
+
+const WINDOW: ConnectorFetchWindow = {
+  startTime: new Date("2026-09-14T11:54:00.000Z"),
+  endTime: new Date("2026-09-14T12:00:00.000Z"),
+};
+
+function collection(id: string, entry: JSONObject): JSONObject {
+  return {
+    id,
+    type: "RULE_DETECTION",
+    detectionTime: "2026-09-14T11:56:00.000Z",
+    createdTime: "2026-09-14T11:57:00.000Z",
+    detection: [{ alertState: "ALERTING", ruleType: "SINGLE_EVENT", ...entry }],
+  };
+}
+
+// A custom rule graded in its meta section, as the rule search returns it.
+const LABELLED_CUSTOM_RULE: JSONObject = collection("de_custom_labelled", {
+  ruleName: "rq_003096_Suspicious_LLMNR_Traffic_Observed",
+  ruleId: "ru_custom_1",
+  ruleLabels: [
+    { key: "author", value: "Detection Engineering" },
+    { key: "severity", value: "Medium" },
+  ],
+  riskScore: 40,
+});
+
+// A custom rule with no severity meta that scores itself with $risk_score.
+const SCORED_CUSTOM_RULE: JSONObject = collection("de_custom_scored", {
+  ruleName: "rq_003944_Inbound_Email_Wave_To_Single_User",
+  ruleId: "ru_custom_2",
+  ruleLabels: [{ key: "author", value: "Detection Engineering" }],
+  outcomes: [
+    { key: "risk_score", value: "85" },
+    { key: "recipient", value: "user@example.com" },
+  ],
+  riskScore: 85,
+});
+
+// A custom rule that grades itself nowhere: Google's default score only.
+const UNGRADED_CUSTOM_RULE: JSONObject = collection("de_custom_ungraded", {
+  ruleName: "rq_000134_Allowed_Malicious_Email",
+  ruleId: "ru_custom_3",
+  ruleLabels: [{ key: "author", value: "Detection Engineering" }],
+  riskScore: 40,
+});
+
+// A curated rule, as the curated search returns it.
+const CURATED_RULE: JSONObject = collection("de_curated_ati", {
+  ruleName: "ATI Medium Priority Rule Match for Ip Address IoCs (principal.ip)",
+  ruleId: FIXTURE_CURATED_RULE_ID,
+  severity: "MEDIUM",
+  ruleLabels: [{ key: "rule_name", value: "ATI Medium Priority Rule Match" }],
+  outcomes: [{ key: "risk_score", value: "60" }],
+  riskScore: 60,
+  ruleSetDisplayName: "Applied Threat Intelligence",
+});
+
+// A custom-rule alert that only the alerts view returned.
+const ALERTS_VIEW_CUSTOM_RULE: JSONObject = collection("de_alerts_view", {
+  ruleName: "rq_004120_Impossible_Travel",
+  ruleId: "ru_custom_4",
+  ruleLabels: [{ key: "severity", value: "HIGH" }],
+  riskScore: 40,
+});
+
+async function pollOnce(): Promise<ConnectorFetchResult> {
+  const fake: FakeClient = makeFakeClient({
+    rule: [
+      page([LABELLED_CUSTOM_RULE, SCORED_CUSTOM_RULE, UNGRADED_CUSTOM_RULE]),
+    ],
+    curated: [page([CURATED_RULE])],
+    // The window's alerts view, then a late-alert sweep that finds nothing.
+    alerts: [fetched([ALERTS_VIEW_CUSTOM_RULE]), fetched([])],
+  });
+
+  return connectorWith(fake.client).connector.fetchEvents(
+    secOpsSettings(),
+    WINDOW,
+    fetchOptions(),
+  );
+}
+
+function eventsById(
+  result: ConnectorFetchResult,
+): Map<string, NormalizedSecurityEvent> {
+  return new Map(
+    result.events.map(
+      (event: NormalizedSecurityEvent): [string, NormalizedSecurityEvent] => {
+        return [event.eventUid, event];
+      },
+    ),
+  );
+}
+
+describe("GoogleSecOpsConnector.fetchEvents severity", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("custom-rule detections are imported graded, beside the curated ones", async () => {
+    const result: ConnectorFetchResult = await pollOnce();
+    const byId: Map<string, NormalizedSecurityEvent> = eventsById(result);
+
+    expect([...byId.keys()].sort()).toEqual([
+      "de_alerts_view",
+      "de_curated_ati",
+      "de_custom_labelled",
+      "de_custom_scored",
+      "de_custom_ungraded",
+    ]);
+
+    const expected: Array<[string, OcsfSeverity]> = [
+      // meta: severity = "Medium"
+      ["de_custom_labelled", OcsfSeverity.Medium],
+      // $risk_score = 85, Google's 80-89 band
+      ["de_custom_scored", OcsfSeverity.High],
+      // nothing graded it; Google's default score of 40 is not a grade
+      ["de_custom_ungraded", OcsfSeverity.Unknown],
+      // Google's own grade
+      ["de_curated_ati", OcsfSeverity.Medium],
+      // meta: severity = "HIGH", read from the alerts view
+      ["de_alerts_view", OcsfSeverity.High],
+    ];
+
+    for (const [id, severity] of expected) {
+      expect({ id, severityName: byId.get(id)!.severityName }).toEqual({
+        id,
+        severityName: severity,
+      });
+      expect(byId.get(id)!.severityId).toBe(OcsfSeverityId[severity]);
+    }
+  });
+
+  test("only the detection whose rule grades itself nowhere is Unknown", async () => {
+    const result: ConnectorFetchResult = await pollOnce();
+
+    expect(
+      result.events
+        .filter((event: NormalizedSecurityEvent): boolean => {
+          return event.severityName === OcsfSeverity.Unknown;
+        })
+        .map((event: NormalizedSecurityEvent): string => {
+          return event.ruleName;
+        }),
+    ).toEqual(["rq_000134_Allowed_Malicious_Email"]);
+  });
+
+  test("the samples the connection page shows carry the same grades", async () => {
+    const result: ConnectorFetchResult = await pollOnce();
+    const severities: Record<string, string> = {};
+
+    for (const sample of result.samples) {
+      severities[sample.id] = (sample as SecurityConnectorSample).severity!;
+    }
+
+    expect(severities).toEqual({
+      de_custom_labelled: "Medium",
+      de_custom_scored: "High",
+      de_custom_ungraded: "Unknown",
+      de_curated_ati: "Medium",
+      de_alerts_view: "High",
+    });
+  });
+
+  test("the rule's labels and outcomes are kept in the imported attributes", async () => {
+    const result: ConnectorFetchResult = await pollOnce();
+    const labelled: NormalizedSecurityEvent =
+      eventsById(result).get("de_custom_labelled")!;
+    const scored: NormalizedSecurityEvent =
+      eventsById(result).get("de_custom_scored")!;
+
+    expect(labelled.attributes).toMatchObject({
+      "detection.0.ruleLabels.1.key": "severity",
+      "detection.0.ruleLabels.1.value": "Medium",
+      "detection.0.riskScore": "40",
+    });
+    expect(scored.attributes).toMatchObject({
+      "detection.0.outcomes.0.key": "risk_score",
+      "detection.0.outcomes.0.value": "85",
+    });
+  });
+});

package/Tests/Server/Utils/SecurityEvent/Connectors/GoogleSecOps/GoogleSecOpsPollingClickhouseIntegration.test.ts

@@ -49,7 +49,7 @@ import {
  *
  * Opt in against a local development ClickHouse server. The suite creates and
  * removes only its own uniquely named database, never application tables.
- * Load local credentials with DOTENV_CONFIG_PATH=../config.env node -r dotenv/config.
+ * Load local credentials with DOTENV_CONFIG_PATH=../../config.env node -r dotenv/config.
  * Set SECOPS_TEST_CLICKHOUSE_URL=http://localhost:8189 to enable the suite.
  */
 const endpoint: string | undefined = process.env["SECOPS_TEST_CLICKHOUSE_URL"];