@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/Middleware/PublicRouteUserMiddleware.test.ts

@@ -0,0 +1,453 @@
+import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
+import ProjectMiddleware from "../../../Server/Middleware/ProjectAuthorization";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import AccessTokenService from "../../../Server/Services/AccessTokenService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import UserService from "../../../Server/Services/UserService";
+import {
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import JSONWebToken from "../../../Server/Utils/JsonWebToken";
+import logger from "../../../Server/Utils/Logger";
+import Response from "../../../Server/Utils/Response";
+import Dictionary from "../../../Types/Dictionary";
+import Email from "../../../Types/Email";
+import Exception from "../../../Types/Exception/Exception";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import Name from "../../../Types/Name";
+import ObjectID from "../../../Types/ObjectID";
+import { UserGlobalAccessPermission } from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { getJestSpyOn } from "../../Spy";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+import jwt from "jsonwebtoken";
+
+/*
+ * getPublicRouteUserMiddleware: getUserMiddleware for the public dashboard and
+ * public status page routes.
+ *
+ * THE BUG
+ *
+ * The host-wide dashboard access-token cookie reaches the public routes
+ * whenever the page is served from the dashboard's host. When that cookie is
+ * still in the browser but no longer decodes - the encryption secret was
+ * rotated, say - getUserMiddleware answered 401 "AccessToken is invalid or
+ * expired" before the route ever asked whether the dashboard was public. The
+ * public clients cannot refresh a dashboard session, so the 401 went straight
+ * to the login redirect: a reload loop on the preview route, and a password
+ * prompt for a master password the viewer had already entered.
+ *
+ * WHAT THIS FILE PINS
+ *
+ *   1. On the public variant, a token that does not decode is anonymity, not
+ *      a refusal: UserType.Public, no identity, next().
+ *   2. Everything else is getUserMiddleware's behaviour: a good token is
+ *      resolved the same way, an API key is still validated, no token is
+ *      still anonymous.
+ *   3. getUserMiddleware itself, which every authenticated route mounts,
+ *      still answers the same tokens with a 401.
+ *
+ * Tokens are signed and decoded with the real JSONWebToken, so "does not
+ * decode" means exactly what it means in production.
+ */
+
+const INVALID_ACCESS_TOKEN_MESSAGE: string =
+  "AccessToken is invalid or expired. Please refresh your token.";
+
+const USER_ID: ObjectID = new ObjectID("33333333-3333-4333-8333-333333333333");
+
+type TokenPayloadFunction = () => Dictionary<string | boolean>;
+
+const tokenPayload: TokenPayloadFunction = (): Dictionary<string | boolean> => {
+  return {
+    userId: USER_ID.toString(),
+    email: "viewer@example.com",
+    name: "Viewer",
+    isMasterAdmin: false,
+    isGlobalLogin: true,
+    sessionId: ObjectID.generate().toString(),
+  };
+};
+
+/*
+ * Each one well-formed enough to be sent as a session, none of them one this
+ * instance will accept.
+ */
+const UNDECODABLE_TOKENS: Array<[string, () => string]> = [
+  [
+    "a token signed with a rotated-out encryption secret",
+    (): string => {
+      return jwt.sign(
+        tokenPayload(),
+        `${EncryptionSecret.toString()}-before-rotation`,
+        { expiresIn: 15 * 60 },
+      );
+    },
+  ],
+  [
+    "an expired token",
+    (): string => {
+      return jwt.sign(tokenPayload(), EncryptionSecret.toString(), {
+        expiresIn: -60,
+      });
+    },
+  ],
+  [
+    "a value that is not a JWT at all",
+    (): string => {
+      return "not-a-jwt";
+    },
+  ],
+];
+
+type SignValidTokenFunction = (data?: { isMasterAdmin?: boolean }) => string;
+
+const signValidToken: SignValidTokenFunction = (data?: {
+  isMasterAdmin?: boolean;
+}): string => {
+  return JSONWebToken.signUserLoginToken({
+    tokenData: {
+      userId: USER_ID,
+      email: new Email("viewer@example.com"),
+      name: new Name("Viewer"),
+      timezone: null,
+      isMasterAdmin: Boolean(data?.isMasterAdmin),
+      isGlobalLogin: true,
+      sessionId: ObjectID.generate(),
+    },
+    expiresInSeconds: 15 * 60,
+  });
+};
+
+type BuildRequestFunction = (data: {
+  cookies?: Dictionary<string>;
+  headers?: Dictionary<string>;
+}) => OneUptimeRequest;
+
+/*
+ * Shaped like a public client's request: the public dashboard and status page
+ * clients send an empty tenantid header, so no tenant is resolved.
+ */
+const buildRequest: BuildRequestFunction = (data: {
+  cookies?: Dictionary<string>;
+  headers?: Dictionary<string>;
+}): OneUptimeRequest => {
+  return {
+    params: {},
+    query: {},
+    body: {},
+    cookies: data.cookies || {},
+    headers: { tenantid: "", ...(data.headers || {}) },
+  } as unknown as OneUptimeRequest;
+};
+
+type MiddlewareFunction = (
+  req: OneUptimeRequest,
+  res: ExpressResponse,
+  next: NextFunction,
+) => Promise<void>;
+
+type MiddlewareCallResult = {
+  nextCalls: Array<Array<unknown>>;
+  sentError: Exception | undefined;
+  sendErrorCallCount: number;
+  headersSet: Array<Array<unknown>>;
+};
+
+type CallMiddlewareFunction = (
+  middleware: MiddlewareFunction,
+  req: OneUptimeRequest,
+) => Promise<MiddlewareCallResult>;
+
+const callMiddleware: CallMiddlewareFunction = async (
+  middleware: MiddlewareFunction,
+  req: OneUptimeRequest,
+): Promise<MiddlewareCallResult> => {
+  const set: jest.Mock = jest.fn();
+  const res: ExpressResponse = { set } as unknown as ExpressResponse;
+  const next: jest.Mock = jest.fn();
+
+  await middleware(req, res, next as unknown as NextFunction);
+
+  const errorCalls: Array<Array<unknown>> = (
+    Response.sendErrorResponse as unknown as jest.Mock
+  ).mock.calls as Array<Array<unknown>>;
+
+  return {
+    nextCalls: next.mock.calls as Array<Array<unknown>>,
+    sentError: errorCalls[0]?.[2] as Exception | undefined,
+    sendErrorCallCount: errorCalls.length,
+    headersSet: set.mock.calls as Array<Array<unknown>>,
+  };
+};
+
+type ExpectServedAnonymouslyFunction = (
+  result: MiddlewareCallResult,
+  req: OneUptimeRequest,
+) => void;
+
+const expectServedAnonymously: ExpectServedAnonymouslyFunction = (
+  result: MiddlewareCallResult,
+  req: OneUptimeRequest,
+): void => {
+  expect(result.sendErrorCallCount).toBe(0);
+  expect(result.nextCalls).toHaveLength(1);
+  // next() with an argument is Express's error path, not a pass.
+  expect(result.nextCalls[0]).toEqual([]);
+  expect(req.userType).toBe(UserType.Public);
+  expect(req.userAuthorization).toBeUndefined();
+  expect(UserMiddleware.isAnonymousRequest(req)).toBe(true);
+};
+
+type ExpectInvalidTokenRefusalFunction = (result: MiddlewareCallResult) => void;
+
+const expectInvalidTokenRefusal: ExpectInvalidTokenRefusalFunction = (
+  result: MiddlewareCallResult,
+): void => {
+  expect(result.nextCalls).toHaveLength(0);
+  expect(result.sendErrorCallCount).toBe(1);
+  expect(result.sentError).toBeInstanceOf(NotAuthenticatedException);
+  expect(result.sentError?.code).toBe(401);
+  expect(result.sentError?.message).toBe(INVALID_ACCESS_TOKEN_MESSAGE);
+};
+
+const GLOBAL_PERMISSION: UserGlobalAccessPermission = {
+  _type: "UserGlobalAccessPermission",
+  projectIds: [],
+  globalPermissions: [],
+};
+
+let getUserGlobalAccessPermission: jest.SpyInstance;
+let userUpdateLastActive: jest.SpyInstance;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+
+  getJestSpyOn(Response, "sendErrorResponse").mockImplementation(() => {
+    return undefined as never;
+  });
+  // JSONWebToken.decode logs every token it refuses.
+  getJestSpyOn(logger, "error").mockImplementation(() => {
+    return undefined;
+  });
+
+  getUserGlobalAccessPermission = getJestSpyOn(
+    AccessTokenService,
+    "getUserGlobalAccessPermission",
+  ).mockResolvedValue(GLOBAL_PERMISSION);
+  userUpdateLastActive = getJestSpyOn(
+    UserService,
+    "updateLastActive",
+  ).mockResolvedValue(undefined);
+  getJestSpyOn(ProjectService, "updateLastActive").mockResolvedValue(undefined);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("UserMiddleware.getPublicRouteUserMiddleware", () => {
+  describe("with an access token that does not decode", () => {
+    test.each(UNDECODABLE_TOKENS)(
+      "serves %s in the access-token cookie anonymously",
+      async (_label: string, token: () => string) => {
+        const req: OneUptimeRequest = buildRequest({
+          cookies: { "user-token": token() },
+        });
+
+        const result: MiddlewareCallResult = await callMiddleware(
+          UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+          req,
+        );
+
+        expectServedAnonymously(result, req);
+      },
+    );
+
+    test.each(UNDECODABLE_TOKENS)(
+      "serves %s in an Authorization: Bearer header anonymously",
+      async (_label: string, token: () => string) => {
+        const req: OneUptimeRequest = buildRequest({
+          headers: { authorization: `Bearer ${token()}` },
+        });
+
+        const result: MiddlewareCallResult = await callMiddleware(
+          UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+          req,
+        );
+
+        expectServedAnonymously(result, req);
+      },
+    );
+
+    /*
+     * Anonymous means anonymous: nothing about the undecodable token's
+     * claimed user is looked up, recorded, or sent back.
+     */
+    test("resolves no user, records no activity and sets no permission headers", async () => {
+      const req: OneUptimeRequest = buildRequest({
+        cookies: { "user-token": "not-a-jwt" },
+      });
+
+      const result: MiddlewareCallResult = await callMiddleware(
+        UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+        req,
+      );
+
+      expect(getUserGlobalAccessPermission).not.toHaveBeenCalled();
+      expect(userUpdateLastActive).not.toHaveBeenCalled();
+      expect(result.headersSet).toEqual([]);
+      expect(req.userGlobalAccessPermission).toBeUndefined();
+      expect(req.userTenantAccessPermission).toBeUndefined();
+    });
+
+    /*
+     * The request comes out exactly as anonymous as one with no token, so a
+     * guard behind it still refuses it. Mounting this middleware by mistake
+     * in front of an authenticated handler cannot promote a dead session.
+     */
+    test("leaves a request that requireUserAuthentication still refuses", async () => {
+      const req: OneUptimeRequest = buildRequest({
+        cookies: { "user-token": "not-a-jwt" },
+      });
+
+      await callMiddleware(
+        UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+        req,
+      );
+
+      const guarded: MiddlewareCallResult = await callMiddleware(
+        UserMiddleware.requireUserAuthentication as MiddlewareFunction,
+        req,
+      );
+
+      expect(guarded.nextCalls).toHaveLength(0);
+      expect(guarded.sentError).toBeInstanceOf(NotAuthenticatedException);
+      expect(guarded.sentError?.message).toBe(
+        UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+      );
+    });
+  });
+
+  describe("otherwise behaves exactly like getUserMiddleware", () => {
+    test.each([
+      ["a signed-in user", false, UserType.User],
+      ["a master admin", true, UserType.MasterAdmin],
+    ])(
+      "resolves %s from a token that decodes",
+      async (_label: string, isMasterAdmin: boolean, userType: UserType) => {
+        const token: string = signValidToken({ isMasterAdmin });
+
+        const publicReq: OneUptimeRequest = buildRequest({
+          cookies: { "user-token": token },
+        });
+        const strictReq: OneUptimeRequest = buildRequest({
+          cookies: { "user-token": token },
+        });
+
+        const publicResult: MiddlewareCallResult = await callMiddleware(
+          UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+          publicReq,
+        );
+        const strictResult: MiddlewareCallResult = await callMiddleware(
+          UserMiddleware.getUserMiddleware as MiddlewareFunction,
+          strictReq,
+        );
+
+        expect(publicResult.sendErrorCallCount).toBe(0);
+        expect(publicResult.nextCalls).toEqual([[]]);
+        expect(publicReq.userType).toBe(userType);
+        expect(publicReq.userAuthorization?.userId.toString()).toBe(
+          USER_ID.toString(),
+        );
+        expect(publicReq.userGlobalAccessPermission).toEqual(GLOBAL_PERMISSION);
+
+        expect(publicReq.userType).toBe(strictReq.userType);
+        expect(publicReq.userAuthorization).toEqual(
+          strictReq.userAuthorization,
+        );
+        expect(publicReq.userGlobalAccessPermission).toEqual(
+          strictReq.userGlobalAccessPermission,
+        );
+        expect(publicResult.headersSet).toEqual(strictResult.headersSet);
+      },
+    );
+
+    test("serves a request with no token anonymously", async () => {
+      const req: OneUptimeRequest = buildRequest({});
+
+      const result: MiddlewareCallResult = await callMiddleware(
+        UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+        req,
+      );
+
+      expectServedAnonymously(result, req);
+    });
+
+    /*
+     * An API key is a credential the caller chose to present, not a stale
+     * cookie the browser happened to attach. It is still handed to the API
+     * key middleware, which decides - before any token is read.
+     */
+    test("still hands an API key to the API key middleware", async () => {
+      const isValidProjectIdAndApiKeyMiddleware: jest.SpyInstance =
+        getJestSpyOn(
+          ProjectMiddleware,
+          "isValidProjectIdAndApiKeyMiddleware",
+        ).mockResolvedValue(undefined);
+
+      const req: OneUptimeRequest = buildRequest({
+        cookies: { "user-token": "not-a-jwt" },
+        headers: { apikey: "not-a-valid-key" },
+      });
+
+      const result: MiddlewareCallResult = await callMiddleware(
+        UserMiddleware.getPublicRouteUserMiddleware as MiddlewareFunction,
+        req,
+      );
+
+      expect(isValidProjectIdAndApiKeyMiddleware).toHaveBeenCalledTimes(1);
+      expect(isValidProjectIdAndApiKeyMiddleware.mock.calls[0]?.[0]).toBe(req);
+      expect(result.nextCalls).toHaveLength(0);
+      expect(req.userType).toBeUndefined();
+    });
+  });
+});
+
+/*
+ * Every authenticated /api route mounts getUserMiddleware. The fix must not
+ * reach it: there a dead session is still a 401, which is what makes the
+ * dashboard client refresh.
+ */
+describe("UserMiddleware.getUserMiddleware (authenticated routes)", () => {
+  test.each(UNDECODABLE_TOKENS)(
+    "still answers %s in the access-token cookie with a 401",
+    async (_label: string, token: () => string) => {
+      const req: OneUptimeRequest = buildRequest({
+        cookies: { "user-token": token() },
+      });
+
+      const result: MiddlewareCallResult = await callMiddleware(
+        UserMiddleware.getUserMiddleware as MiddlewareFunction,
+        req,
+      );
+
+      expectInvalidTokenRefusal(result);
+      expect(req.userType).toBeUndefined();
+    },
+  );
+
+  test.each(UNDECODABLE_TOKENS)(
+    "still answers %s in an Authorization: Bearer header with a 401",
+    async (_label: string, token: () => string) => {
+      const result: MiddlewareCallResult = await callMiddleware(
+        UserMiddleware.getUserMiddleware as MiddlewareFunction,
+        buildRequest({ headers: { authorization: `Bearer ${token()}` } }),
+      );
+
+      expectInvalidTokenRefusal(result);
+    },
+  );
+});

package/Tests/Server/Services/AIChatPrivacyPin.test.ts

@@ -24,7 +24,9 @@ import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import Permission, {
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import UserType from "../../../Types/UserType";
 import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
 import { afterEach, describe, expect, jest, test } from "@jest/globals";
@@ -107,11 +109,20 @@ const memberProps: (userId: ObjectID) => DatabaseCommonInteractionProps = (
  */
 const apiKeyProps: DatabaseCommonInteractionProps = {
   tenantId: PROJECT_ID,
+  userType: UserType.API,
   userTenantAccessPermission: {} as {
     [tenantId: string]: UserTenantAccessPermission;
   },
 } as unknown as DatabaseCommonInteractionProps;
 
+/*
+ * No credentials at all — what an expired dashboard session looks like. That
+ * caller must get a 401 (so the client refreshes and replays), not a 403/422.
+ */
+const anonymousProps: DatabaseCommonInteractionProps = {
+  tenantId: PROJECT_ID,
+} as unknown as DatabaseCommonInteractionProps;
+
 /*
  * Renders a (possibly nested) TypeORM FindOperator tree to text, including
  * the parameters of a Raw operator — QueryHelper.equalTo hides its value
@@ -449,6 +460,19 @@ describe("AI chat privacy pin — the personal-scope guarantee", () => {
       ).rejects.toThrow(NotAuthorizedException);
     });
 
+    test("asks an anonymous caller to authenticate rather than reading unscoped", async () => {
+      await expect(pinnedFindQuery(table, {}, anonymousProps)).rejects.toThrow(
+        NotAuthenticatedException,
+      );
+
+      await expect(
+        table.service.countBy({
+          query: {},
+          props: anonymousProps,
+        }),
+      ).rejects.toThrow(NotAuthenticatedException);
+    });
+
     test("leaves root and master-admin reads unpinned", async () => {
       const asRoot: Record<string, unknown> = await pinnedFindQuery(table, {}, {
         isRoot: true,

package/Tests/Server/Services/ApiKeyPermissionSecurity.test.ts

@@ -612,6 +612,7 @@ describe("ApiKeyPermissionService update boundaries", () => {
           userPermission({
             permission: Permission.EditProjectApiKeyPermissions,
           }),
+          userPermission({ permission: Permission.ReadProjectApiKey }),
           userPermission({
             permission: Permission.TelemetryAdmin,
             labels: [allowedLabelId],
@@ -636,6 +637,7 @@ describe("ApiKeyPermissionService update boundaries", () => {
           userPermission({
             permission: Permission.EditProjectApiKeyPermissions,
           }),
+          userPermission({ permission: Permission.ReadProjectApiKey }),
           userPermission({
             permission: Permission.TelemetryAdmin,
             labels: [allowedLabelId],

package/Tests/Server/Services/ApiKeyPermissionService.test.ts

@@ -444,11 +444,11 @@ describe("ApiKeyPermissionService.findPermissionsByApiKeyId", () => {
         projectId,
       );
       /*
-       * One query is the update hook's security snapshot of the affected
-       * permission rows; the third call proves the cached auth result was
+       * Two queries select the update's IDs and load their complete security
+       * snapshot; the fourth call proves the cached auth result was
        * evicted and had to be loaded again afterwards.
        */
-      expect(findBy).toHaveBeenCalledTimes(3);
+      expect(findBy).toHaveBeenCalledTimes(4);
     });
 
     test("deleting a permission clears the cache", async () => {

package/Tests/Server/Services/DatabaseServiceCreateSuppliedId.test.ts

@@ -0,0 +1,147 @@
+import MonitorService from "../../../Server/Services/MonitorService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * A create builds a brand-new row, so the payload must not carry the row's own
+ * primary key. `getRepository().save()` treats an entity that already has an id
+ * as an update of that existing row rather than an insert, so an `_id` left on
+ * a create payload makes the "create" modify a record the caller never named.
+ *
+ * Two layers keep that from happening, and these tests pin both:
+ *   - BaseAPI.createItem strips the top-level id from the model it builds
+ *     (BaseModel.fromJSON folds a client `id` into `_id`, so both spellings go).
+ *   - DatabaseService.create refuses a pre-set `_id` from a non-root caller
+ *     before any hook or query runs. Root/internal seeding assigns ids and is
+ *     exempt.
+ *
+ * Nested `_id`s inside relation objects/arrays are left alone - they reference
+ * existing related rows and are a normal part of a create payload.
+ */
+
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "00000000-0000-4000-8000-00000000000a",
+);
+const CALLER_PROJECT_ID: ObjectID = new ObjectID(
+  "00000000-0000-4000-8000-00000000000b",
+);
+// The id of a row that already exists.
+const EXISTING_ROW_ID: string = "00000000-0000-4000-8000-0000000000cc";
+
+const memberProps: (
+  permissions: Array<Permission>,
+) => DatabaseCommonInteractionProps = (
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps => {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId: CALLER_PROJECT_ID,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission): UserPermission => {
+      return {
+        _type: "UserPermission",
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId: new ObjectID("00000000-0000-4000-8000-000000000003"),
+    tenantId: CALLER_PROJECT_ID,
+    userType: UserType.User,
+    userTenantAccessPermission: {
+      [CALLER_PROJECT_ID.toString()]: tenantPermission,
+    },
+  };
+};
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("Primary keys supplied on a create payload", () => {
+  test("BaseAPI.createItem strips the top-level id its model builder produced", () => {
+    /*
+     * BaseModel.fromJSON maps a client `id` -> `_id` and keeps `_id`; this is
+     * how a request body's id ends up on the entity in the first place.
+     */
+    const created: Monitor = BaseModel.fromJSON<Monitor>(
+      { id: EXISTING_ROW_ID, name: "x" } as JSONObject,
+      Monitor,
+    ) as Monitor;
+    expect(created._id).toBe(EXISTING_ROW_ID);
+
+    // What BaseAPI.createItem now does to that entity before create().
+    delete (created as unknown as { _id?: string })._id;
+    delete (created as unknown as { id?: string }).id;
+    expect(created._id).toBeUndefined();
+
+    /*
+     * A nested relation id (Entity/EntityArray) must survive that strip - it
+     * references an existing related row, not the row being created.
+     */
+    const withRelation: Monitor = BaseModel.fromJSON<Monitor>(
+      {
+        _id: EXISTING_ROW_ID,
+        name: "x",
+        labels: [{ _id: "00000000-0000-4000-8000-0000000000dd" }],
+      } as JSONObject,
+      Monitor,
+    ) as Monitor;
+    delete (withRelation as unknown as { _id?: string })._id;
+    expect(withRelation._id).toBeUndefined();
+    expect(
+      (withRelation.labels && withRelation.labels[0]?._id) || undefined,
+    ).toBe("00000000-0000-4000-8000-0000000000dd");
+  });
+
+  test("DatabaseService.create refuses a non-root create carrying an _id, before any hook or query", async () => {
+    /*
+     * If the refusal ever regresses, the spies below would let a full create
+     * run; fail loudly instead by making the first thing create() would reach
+     * after the check throw.
+     */
+    const repoSpy: jest.SpyInstance = jest
+      .spyOn(MonitorService, "getRepository")
+      .mockImplementation((() => {
+        throw new Error("save() must not be reached for an _id create");
+      }) as never) as unknown as jest.SpyInstance;
+    const hookSpy: jest.SpyInstance = jest.spyOn(
+      MonitorService,
+      "onBeforeCreate" as never,
+    ) as unknown as jest.SpyInstance;
+
+    const incoming: Monitor = new Monitor();
+    incoming._id = EXISTING_ROW_ID;
+    incoming.name = "renamed";
+
+    const createBy: CreateBy<Monitor> = {
+      data: incoming,
+      props: memberProps([
+        Permission.CreateProjectMonitor,
+        Permission.ProjectMember,
+      ]),
+    };
+
+    await expect(MonitorService.create(createBy)).rejects.toBeInstanceOf(
+      BadDataException,
+    );
+    expect(hookSpy).not.toHaveBeenCalled();
+    expect(repoSpy).not.toHaveBeenCalled();
+
+    // Guard against a false pass if the two ids were ever made equal.
+    expect(OTHER_PROJECT_ID.toString()).not.toBe(CALLER_PROJECT_ID.toString());
+  });
+});