@oneuptime/common 13.0.6 → 13.0.8

package/Tests/Server/Services/DatabaseServiceWriteOperatorValues.test.ts

@@ -0,0 +1,147 @@
+import ProbeService from "../../../Server/Services/ProbeService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Probe from "../../../Models/DatabaseModels/Probe";
+import StartsWith from "../../../Types/BaseDatabase/StartsWith";
+import NotNull from "../../../Types/BaseDatabase/NotNull";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * Query operators belong in the `query` of a read/update, never in the `data`
+ * of a write. A request value shaped like a serialized operator, e.g.
+ * {"_type":"StartsWith","value":"a"} or {"_type":"NotNull"}, becomes a real
+ * operator instance: JSONFunctions.deserialize runs on every request body while
+ * DatabaseBaseModel._fromJSON builds the model, and the operator is assigned to
+ * the column unchanged.
+ *
+ * An operator is never a valid stored value, and one left on a write payload is
+ * also fed to the lookups built from that data (the uniqueness check, service
+ * hooks), where it turns an intended exact comparison into a pattern match.
+ * DatabaseService rejects such a write up front, before any hook or query runs.
+ * JSON columns are exempt - they legitimately hold arbitrary objects.
+ *
+ * The first two tests document the deserialization behaviour, which is
+ * unchanged; the last two pin the rejection and that ordinary writes still pass.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "00000000-0000-4000-8000-00000000000a",
+);
+
+const memberProps: (
+  permissions: Array<Permission>,
+) => DatabaseCommonInteractionProps = (
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps => {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId: PROJECT_ID,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission): UserPermission => {
+      return {
+        _type: "UserPermission",
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId: new ObjectID("00000000-0000-4000-8000-000000000003"),
+    tenantId: PROJECT_ID,
+    userType: UserType.User,
+    userTenantAccessPermission: {
+      [PROJECT_ID.toString()]: tenantPermission,
+    },
+  };
+};
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("Query operators supplied as write values", () => {
+  test("request body value {_type:StartsWith} deserializes into a StartsWith on a text column", () => {
+    const body: JSONObject = {
+      key: { _type: "StartsWith", value: "a" } as unknown as JSONObject,
+      name: "a probe",
+    };
+
+    const probe: Probe = BaseModel.fromJSON<Probe>(body, Probe) as Probe;
+
+    expect(probe.key).toBeInstanceOf(StartsWith);
+    expect((probe.key as unknown as StartsWith<string>).toString()).toBe("a");
+  });
+
+  test("request body value {_type:NotNull} deserializes into a NotNull operator", () => {
+    const body: JSONObject = {
+      key: { _type: "NotNull" } as unknown as JSONObject,
+    };
+
+    const probe: Probe = BaseModel.fromJSON<Probe>(body, Probe) as Probe;
+    expect(probe.key).toBeInstanceOf(NotNull);
+  });
+
+  test("DatabaseService.create rejects an operator in write data before any lookup", async () => {
+    /*
+     * If the check regresses, the uniqueness check would run its countBy with
+     * the operator in the query; make that fail loudly instead.
+     */
+    const countSpy: jest.SpyInstance = jest
+      .spyOn(ProbeService, "countBy")
+      .mockImplementation((() => {
+        throw new Error("countBy must not run for an operator-carrying create");
+      }) as never) as unknown as jest.SpyInstance;
+    const hookSpy: jest.SpyInstance = jest.spyOn(
+      ProbeService,
+      "onBeforeCreate" as never,
+    ) as unknown as jest.SpyInstance;
+
+    const probe: Probe = new Probe();
+    (probe as unknown as { key: unknown }).key = new StartsWith("a");
+    probe.name = "a probe";
+
+    const createBy: CreateBy<Probe> = {
+      data: probe,
+      props: memberProps([Permission.CreateProjectProbe]),
+    };
+
+    await expect(ProbeService.create(createBy)).rejects.toBeInstanceOf(
+      BadDataException,
+    );
+    expect(hookSpy).not.toHaveBeenCalled();
+    expect(countSpy).not.toHaveBeenCalled();
+  });
+
+  test("the operator check leaves an ordinary create untouched", () => {
+    /*
+     * The check must refuse operators without touching plain values. Call it
+     * directly - it is the choke point create()/update() run - and assert a
+     * normal payload passes while an operator is refused.
+     */
+    const legit: Probe = new Probe();
+    legit.key = "a-real-plaintext-key";
+    legit.name = "a probe";
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const service: any = ProbeService as any;
+    expect(() => {
+      service.rejectQueryOperatorsInData(legit);
+    }).not.toThrow();
+
+    const withOperator: Probe = new Probe();
+    (withOperator as unknown as { key: unknown }).key = new StartsWith("a");
+    expect(() => {
+      service.rejectQueryOperatorsInData(withOperator);
+    }).toThrow(BadDataException);
+  });
+});

package/Tests/Server/Services/MonitorDescriptionValidation.test.ts

@@ -0,0 +1,211 @@
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import MonitorTemplate from "../../../Models/DatabaseModels/MonitorTemplate";
+import DatabaseService from "../../../Server/Services/DatabaseService";
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import PartialEntity from "../../../Types/Database/PartialEntity";
+import {
+  getKubernetesAlertTemplateById,
+  KubernetesAlertTemplate,
+} from "../../../Types/Monitor/KubernetesAlertTemplates";
+import { describe, expect, it } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import { ColumnMetadataArgs } from "typeorm/metadata-args/ColumnMetadataArgs";
+
+const service: DatabaseService<Monitor> = new DatabaseService<Monitor>(Monitor);
+const templateService: DatabaseService<MonitorTemplate> =
+  new DatabaseService<MonitorTemplate>(MonitorTemplate);
+
+const markdownDescription: string = [
+  "# Pod CPU Saturating Container Limit",
+  "",
+  "Investigate CPU throttling before changing the container resource limits.",
+  "",
+  "- Namespace: `production`",
+  "- Runbook: https://example.com/runbooks/cpu-throttling",
+  "- Escalation: Platform team — investigate sustained saturation 🔍",
+  "",
+  "```sh",
+  "kubectl top pods --namespace production",
+  "```",
+]
+  .join("\n")
+  .repeat(1000);
+
+/*
+ * Both monitor create and update call this shared sanitizer. Exercise the
+ * real length validation so changing only the form, or increasing its limit
+ * to another fixed value, cannot reintroduce failed monitor saves.
+ */
+describe.each([
+  { operation: "create", isUpdate: false },
+  { operation: "update", isUpdate: true },
+])(
+  "Monitor description validation on $operation",
+  ({ isUpdate }: { isUpdate: boolean }): void => {
+    it.each([
+      { label: "an empty description", description: "" },
+      {
+        label: "the previous 500-character boundary",
+        description: "a".repeat(500),
+      },
+      { label: "501 characters", description: "a".repeat(501) },
+      { label: "a long Markdown runbook", description: markdownDescription },
+    ])(
+      "preserves $label without truncation",
+      async ({ description }: { description: string }): Promise<void> => {
+        const result: Monitor | PartialEntity<Monitor> = await service[
+          "sanitizeCreateOrUpdate"
+        ]({ description: description }, { isRoot: true }, isUpdate);
+
+        expect(result.description).toBe(description);
+      },
+    );
+
+    it("allows the optional description to be omitted", async () => {
+      const result: Monitor | PartialEntity<Monitor> = await service[
+        "sanitizeCreateOrUpdate"
+      ]({ name: "Pod CPU" }, { isRoot: true }, isUpdate);
+
+      expect(result.description).toBeUndefined();
+    });
+
+    it("accepts the built-in Pod CPU Saturating Container Limit recommendation", async () => {
+      const template: KubernetesAlertTemplate | undefined =
+        getKubernetesAlertTemplateById("k8s-pod-cpu-limit-saturation");
+
+      expect(template).toBeDefined();
+      expect(template!.description.length).toBeGreaterThan(500);
+
+      const result: Monitor | PartialEntity<Monitor> = await service[
+        "sanitizeCreateOrUpdate"
+      ](
+        { name: template!.name, description: template!.description },
+        { isRoot: true },
+        isUpdate,
+      );
+
+      expect(result.description).toBe(template!.description);
+    });
+
+    it("still enforces the monitor name length", async () => {
+      await expect(
+        service["sanitizeCreateOrUpdate"](
+          {
+            name: "a".repeat(ColumnLength.ShortText + 1),
+            description: markdownDescription,
+          },
+          { isRoot: true },
+          isUpdate,
+        ),
+      ).rejects.toThrow(
+        `name length cannot be more than ${ColumnLength.ShortText} characters`,
+      );
+    });
+  },
+);
+
+describe.each([
+  { operation: "create", isUpdate: false },
+  { operation: "update", isUpdate: true },
+])(
+  "Template monitor description validation on $operation",
+  ({ isUpdate }: { isUpdate: boolean }): void => {
+    it.each([
+      { label: "501 characters", description: "a".repeat(501) },
+      { label: "a long Markdown runbook", description: markdownDescription },
+    ])(
+      "preserves $label for generated monitors",
+      async ({ description }: { description: string }): Promise<void> => {
+        const result: MonitorTemplate | PartialEntity<MonitorTemplate> =
+          await templateService["sanitizeCreateOrUpdate"](
+            { monitorDescription: description },
+            { isRoot: true },
+            isUpdate,
+          );
+
+        expect(result.monitorDescription).toBe(description);
+      },
+    );
+
+    it("allows the optional monitor description to be omitted", async () => {
+      const result: MonitorTemplate | PartialEntity<MonitorTemplate> =
+        await templateService["sanitizeCreateOrUpdate"](
+          { templateName: "Pod CPU template" },
+          { isRoot: true },
+          isUpdate,
+        );
+
+      expect(result.monitorDescription).toBeUndefined();
+    });
+
+    it("still enforces the separate template description length", async () => {
+      await expect(
+        templateService["sanitizeCreateOrUpdate"](
+          {
+            templateDescription: "a".repeat(ColumnLength.LongText + 1),
+            monitorDescription: markdownDescription,
+          },
+          { isRoot: true },
+          isUpdate,
+        ),
+      ).rejects.toThrow(
+        `templateDescription length cannot be more than ${ColumnLength.LongText} characters`,
+      );
+    });
+  },
+);
+
+describe.each([
+  { modelType: Monitor, columnName: "description" },
+  { modelType: MonitorTemplate, columnName: "monitorDescription" },
+])(
+  "$modelType.name.$columnName storage",
+  ({
+    modelType,
+    columnName,
+  }: {
+    modelType: typeof Monitor | typeof MonitorTemplate;
+    columnName: string;
+  }): void => {
+    it("uses text without a database character limit", () => {
+      const column: ColumnMetadataArgs | undefined =
+        getMetadataArgsStorage().columns.find(
+          (metadata: ColumnMetadataArgs) => {
+            return (
+              metadata.target === modelType &&
+              metadata.propertyName === columnName
+            );
+          },
+        );
+
+      expect(column).toBeDefined();
+      expect(column?.options.type).toBe("text");
+      expect(column?.options.length).toBeUndefined();
+      expect(column?.options.nullable).toBe(true);
+      expect(new modelType().getTableColumnMetadata(columnName).required).toBe(
+        false,
+      );
+    });
+  },
+);
+
+describe("Clearing monitor descriptions", () => {
+  it("allows an existing description to be cleared", async () => {
+    const result: Monitor | PartialEntity<Monitor> = await service[
+      "sanitizeCreateOrUpdate"
+    ]({ description: null }, { isRoot: true }, true);
+
+    expect(result.description).toBeNull();
+  });
+
+  it("allows an existing template monitor description to be cleared", async () => {
+    const result: MonitorTemplate | PartialEntity<MonitorTemplate> =
+      await templateService["sanitizeCreateOrUpdate"](
+        { monitorDescription: null },
+        { isRoot: true },
+        true,
+      );
+
+    expect(result.monitorDescription).toBeNull();
+  });
+});

package/Tests/Server/Services/MonitorPayAsYouGoBilling.test.ts

@@ -2,15 +2,19 @@ import MonitorService from "../../../Server/Services/MonitorService";
 import MonitorStatusService from "../../../Server/Services/MonitorStatusService";
 import ProjectService from "../../../Server/Services/ProjectService";
 import PayAsYouGoBillingService from "../../../Server/Services/PayAsYouGoBillingService";
+import BillingService from "../../../Server/Services/BillingService";
 import MonitorStepsProjectValidator from "../../../Server/Utils/Monitor/MonitorStepsProjectValidator";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import MonitorStatus from "../../../Models/DatabaseModels/MonitorStatus";
+import Project from "../../../Models/DatabaseModels/Project";
 import CreateBy from "../../../Server/Types/Database/CreateBy";
 import UpdateBy from "../../../Server/Types/Database/UpdateBy";
 import MonitorType from "../../../Types/Monitor/MonitorType";
 import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
-import { PlanType } from "../../../Types/Billing/SubscriptionPlan";
+import SubscriptionPlan, {
+  PlanType,
+} from "../../../Types/Billing/SubscriptionPlan";
 import PaymentRequiredException from "../../../Types/Exception/PaymentRequiredException";
 import * as EnvironmentConfig from "../../../Server/EnvironmentConfig";
 import {
@@ -89,6 +93,30 @@ function expectPaymentCheckedFor(project: ObjectID): void {
   }
 }
 
+function useRealPaymentEligibility(plan: PlanType): void {
+  jest.mocked(PayAsYouGoBillingService.canUsePayAsYouGo).mockRestore();
+  PayAsYouGoBillingService.invalidate(projectId);
+  PayAsYouGoBillingService.invalidate(otherProjectId);
+  jest.spyOn(BillingService, "isBillingEnabled").mockReturnValue(true);
+  jest.spyOn(BillingService, "hasPaymentMethods").mockResolvedValue(false);
+  jest.spyOn(BillingService, "getSubscription");
+  jest.spyOn(ProjectService, "findOneById").mockResolvedValue(
+    Object.assign(new Project(), {
+      paymentProviderPlanId: plan,
+      paymentProviderCustomerId: "cus_monitor_project",
+    }),
+  );
+  jest
+    .spyOn(SubscriptionPlan, "getSubscriptionPlanById")
+    .mockReturnValue(
+      new SubscriptionPlan(plan, `${plan}_yearly`, plan, 0, 0, 0, 0),
+    );
+  jest.spyOn(ProjectService, "getCurrentPlan").mockResolvedValue({
+    plan,
+    isSubscriptionUnpaid: false,
+  });
+}
+
 beforeEach(() => {
   jest.restoreAllMocks();
   (EnvironmentConfig as { IsBillingEnabled: boolean }).IsBillingEnabled = true;
@@ -300,3 +328,89 @@ describe("monitor update payment admission", () => {
     expect(MonitorService.findBy).not.toHaveBeenCalled();
   });
 });
+
+describe("monitor operations use the stored subscription plan for payment eligibility", () => {
+  test.each([PlanType.Growth, PlanType.Scale, PlanType.Enterprise])(
+    "allows active monitor creation on %s without a payment method",
+    async (plan: PlanType) => {
+      useRealPaymentEligibility(plan);
+
+      await expect(
+        hooks.onBeforeCreate(createInput(MonitorType.Website)),
+      ).resolves.toBeDefined();
+
+      expect(ProjectService.findOneById).toHaveBeenCalledWith(
+        expect.objectContaining({ id: projectId }),
+      );
+      expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+      expect(BillingService.getSubscription).not.toHaveBeenCalled();
+      expect(MonitorService.countBy).not.toHaveBeenCalled();
+    },
+  );
+
+  describe.each([PlanType.Growth, PlanType.Scale, PlanType.Enterprise])(
+    "%s monitor updates without a payment method",
+    (plan: PlanType) => {
+      test.each([
+        { disableActiveMonitoring: false },
+        { monitorType: MonitorType.API },
+      ])(
+        "allows the billable update %j",
+        async (data: UpdateBy<Monitor>["data"]) => {
+          useRealPaymentEligibility(plan);
+          jest
+            .spyOn(MonitorService, "findBy")
+            .mockResolvedValue([
+              storedMonitor(otherProjectId, MonitorType.Website),
+            ]);
+
+          await expect(
+            hooks.onBeforeUpdate(updateInput(data)),
+          ).resolves.toBeDefined();
+
+          expect(ProjectService.findOneById).toHaveBeenCalledWith(
+            expect.objectContaining({ id: otherProjectId }),
+          );
+          expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+        },
+      );
+    },
+  );
+
+  test("still rejects Free monitor creation and re-enabling without a payment method", async () => {
+    useRealPaymentEligibility(PlanType.Free);
+    jest
+      .spyOn(MonitorService, "findBy")
+      .mockResolvedValue([storedMonitor(projectId, MonitorType.Website)]);
+
+    await expect(
+      hooks.onBeforeCreate(createInput(MonitorType.Website)),
+    ).rejects.toBeInstanceOf(PaymentRequiredException);
+    await expect(
+      hooks.onBeforeUpdate(updateInput({ disableActiveMonitoring: false })),
+    ).rejects.toBeInstanceOf(PaymentRequiredException);
+
+    expect(BillingService.hasPaymentMethods).toHaveBeenCalledWith(
+      "cus_monitor_project",
+    );
+    expect(MonitorStatusService.findOneBy).not.toHaveBeenCalled();
+  });
+
+  test.each([PlanType.Growth, PlanType.Scale, PlanType.Enterprise])(
+    "retains the separate unpaid %s subscription check after exempting payment setup",
+    async (plan: PlanType) => {
+      useRealPaymentEligibility(plan);
+      jest.spyOn(ProjectService, "getCurrentPlan").mockResolvedValue({
+        plan,
+        isSubscriptionUnpaid: true,
+      });
+
+      await expect(
+        hooks.onBeforeCreate(createInput(MonitorType.Website)),
+      ).rejects.toThrow("subscription is unpaid");
+
+      expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+      expect(MonitorStatusService.findOneBy).not.toHaveBeenCalled();
+    },
+  );
+});