@oneuptime/common 13.0.7 → 14.0.0

package/Tests/UI/Components/EditionLabelLicenseWritesGuard.test.tsx

@@ -0,0 +1,157 @@
+import { describe, expect, it } from "@jest/globals";
+import fs from "fs";
+import path from "path";
+
+/*
+ * The edition dialog in core only READS the license. Activating it (with a
+ * key or an offline token) and refreshing it are POSTs to routes that exist
+ * only in the Enterprise server (ee/Server/License/API/LicenseClientAPI.ts),
+ * and their UI is the Enterprise plugin's license manager
+ * (ee/AdminDashboard/License). This guard keeps that code from drifting back
+ * into the Apache-2.0 component, where it would ship in every Community
+ * bundle: EditionLabel's branches key on a runtime flag, so the bundler
+ * cannot drop them.
+ *
+ * It scans every source file in the EditionLabel directory, so a new file
+ * next to EditionLabel.tsx cannot bring the code back either.
+ */
+
+const EDITION_LABEL_DIR: string = path.resolve(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  "UI",
+  "Components",
+  "EditionLabel",
+);
+
+interface ForbiddenPattern {
+  pattern: RegExp;
+  why: string;
+}
+
+const FORBIDDEN: Array<ForbiddenPattern> = [
+  {
+    pattern: /\/license\/refresh/,
+    why: "the license refresh route (POST /global-config/license/refresh)",
+  },
+  {
+    pattern: /\blicenseToken\b/,
+    why: "the offline activation request body ({ licenseToken })",
+  },
+  {
+    pattern: /HTTPMethod\.(POST|PUT|PATCH|DELETE)\b/,
+    why: "a license write",
+  },
+  {
+    pattern: /\bAPI\.(post|put|patch|delete)\b/,
+    why: "a license write",
+  },
+  {
+    pattern: /\bmethod:\s*["'](POST|PUT|PATCH|DELETE)["']/i,
+    why: "a license write",
+  },
+  {
+    pattern: /from\s+["'][./]*\/(Input\/Input|TextArea\/TextArea)["']/,
+    why: "the license key / offline token inputs",
+  },
+];
+
+type FindViolationsFunction = (source: string) => Array<string>;
+
+const findViolations: FindViolationsFunction = (
+  source: string,
+): Array<string> => {
+  return FORBIDDEN.filter((entry: ForbiddenPattern): boolean => {
+    return entry.pattern.test(source);
+  }).map((entry: ForbiddenPattern): string => {
+    return entry.why;
+  });
+};
+
+const SOURCE_FILE: RegExp = /\.(ts|tsx|js|jsx)$/;
+
+const listSourceFiles: () => Array<string> = (): Array<string> => {
+  return fs
+    .readdirSync(EDITION_LABEL_DIR)
+    .filter((name: string): boolean => {
+      return SOURCE_FILE.test(name);
+    })
+    .map((name: string): string => {
+      return path.join(EDITION_LABEL_DIR, name);
+    });
+};
+
+describe("the core edition dialog never writes the license", () => {
+  it("scans EditionLabel.tsx and the license manager contract", () => {
+    const names: Array<string> = listSourceFiles().map(
+      (file: string): string => {
+        return path.basename(file);
+      },
+    );
+
+    expect(names).toEqual(
+      expect.arrayContaining(["EditionLabel.tsx", "LicenseManager.ts"]),
+    );
+  });
+
+  it.each(
+    listSourceFiles().map((file: string): [string, string] => {
+      return [path.basename(file), file];
+    }),
+  )(
+    "%s holds no license write, activation input or refresh",
+    (_name: string, file: string) => {
+      expect(findViolations(fs.readFileSync(file, "utf8"))).toEqual([]);
+    },
+  );
+
+  it("still reads the license with a GET", () => {
+    const source: string = fs.readFileSync(
+      path.join(EDITION_LABEL_DIR, "EditionLabel.tsx"),
+      "utf8",
+    );
+
+    expect(source).toContain("HTTPMethod.GET");
+    expect(source).toContain('new Route("/global-config/license")');
+  });
+
+  // Negative control: every pattern fires on the code that moved to ee.
+  it.each([
+    [
+      'new Route("/global-config/license/refresh")',
+      "the license refresh route (POST /global-config/license/refresh)",
+    ],
+    [
+      "data: { licenseToken: trimmedToken }",
+      "the offline activation request body ({ licenseToken })",
+    ],
+    ["method: HTTPMethod.POST,", "a license write"],
+    ["await API.post<JSONObject>({ url })", "a license write"],
+    ['{ method: "POST", url }', "a license write"],
+    [
+      'import Input from "../Input/Input";',
+      "the license key / offline token inputs",
+    ],
+    [
+      'import TextArea from "../TextArea/TextArea";',
+      "the license key / offline token inputs",
+    ],
+  ])("flags %s", (source: string, why: string) => {
+    expect(findViolations(source)).toContain(why);
+  });
+
+  it("does not flag the read-only code that stays", () => {
+    expect(
+      findViolations(
+        [
+          'const licenseUrl: URL = URL.fromURL(APP_API_URL).addRoute(new Route("/global-config/license"));',
+          "await API.fetch<JSONObject>({ method: HTTPMethod.GET, url: licenseUrl });",
+          'configModel.enterpriseLicenseKey = payload["licenseKey"] as string;',
+          'import Button, { ButtonStyleType } from "../Button/Button";',
+        ].join("\n"),
+      ),
+    ).toEqual([]);
+  });
+});

package/Tests/UI/Components/EventAttachmentList.test.tsx

@@ -0,0 +1,174 @@
+import EventAttachmentList, {
+  EventAttachment,
+} from "../../../UI/Components/AttachmentList/EventAttachmentList";
+import "@testing-library/jest-dom";
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+import React from "react";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import type { SpyInstance } from "jest-mock";
+
+/*
+ * A private status page serves note attachments behind the reader's
+ * session. The cards are plain links, and a plain link gets none of the API
+ * class's refresh-and-replay, so a reader who had the page open past the
+ * 15-minute access token opened every attachment as a 401. Given a
+ * refreshSession, a click refreshes before the new tab loads; without one
+ * (public pages) the cards stay the plain links they were.
+ */
+
+const ATTACHMENT: EventAttachment = {
+  name: "postmortem.pdf",
+  downloadUrl:
+    "/status-page-api/incident-public-note/attachment/sp/incident/note/file",
+};
+
+interface FakeTab {
+  opener: unknown;
+  closed: boolean;
+  location: { href: string };
+}
+
+type WindowOpenMock = SpyInstance<typeof window.open>;
+
+// Lets every pending promise chain run to completion.
+async function flushPromises(): Promise<void> {
+  await new Promise<void>((resolve: () => void): void => {
+    setTimeout(resolve, 0);
+  });
+}
+
+/*
+ * Whether the component took the click over, read after React has handled
+ * it. jsdom does not implement navigation, so the link's own default is
+ * stopped here too, once that has been recorded.
+ */
+let lastClickWasPrevented: boolean | null = null;
+
+const recordAndStopClick: (event: MouseEvent) => void = (
+  event: MouseEvent,
+): void => {
+  lastClickWasPrevented = event.defaultPrevented;
+  event.preventDefault();
+};
+
+let windowOpen: WindowOpenMock;
+let tab: FakeTab;
+
+beforeEach(() => {
+  lastClickWasPrevented = null;
+  document.addEventListener("click", recordAndStopClick);
+
+  tab = { opener: window, closed: false, location: { href: "" } };
+  windowOpen = jest.spyOn(window, "open").mockImplementation((): Window => {
+    return tab as unknown as Window;
+  });
+});
+
+afterEach(() => {
+  cleanup();
+  document.removeEventListener("click", recordAndStopClick);
+  jest.restoreAllMocks();
+});
+
+describe("EventAttachmentList", () => {
+  test("without refreshSession the card is a plain link the browser follows by itself", () => {
+    render(<EventAttachmentList attachments={[ATTACHMENT]} />);
+
+    const link: HTMLElement = screen.getByTitle(ATTACHMENT.name);
+
+    expect(link).toHaveAttribute("href", ATTACHMENT.downloadUrl);
+    expect(link).toHaveAttribute("target", "_blank");
+
+    fireEvent.click(link);
+
+    expect(lastClickWasPrevented).toBe(false);
+    expect(windowOpen).not.toHaveBeenCalled();
+  });
+
+  test("with refreshSession a click refreshes the session first, then opens the attachment", async () => {
+    let finishRefresh: (value: boolean) => void = (): void => {};
+    const refreshSession: ReturnType<typeof jest.fn<() => Promise<boolean>>> =
+      jest.fn<() => Promise<boolean>>((): Promise<boolean> => {
+        return new Promise<boolean>(
+          (resolve: (value: boolean) => void): void => {
+            finishRefresh = resolve;
+          },
+        );
+      });
+
+    render(
+      <EventAttachmentList
+        attachments={[ATTACHMENT]}
+        refreshSession={refreshSession}
+      />,
+    );
+
+    const link: HTMLElement = screen.getByTitle(ATTACHMENT.name);
+
+    // The href stays for middle-click and "copy link address".
+    expect(link).toHaveAttribute("href", ATTACHMENT.downloadUrl);
+
+    fireEvent.click(link);
+
+    expect(lastClickWasPrevented).toBe(true);
+    expect(refreshSession).toHaveBeenCalledTimes(1);
+    expect(windowOpen).toHaveBeenCalledWith("", "_blank");
+
+    await flushPromises();
+    expect(tab.location.href).toBe("");
+
+    finishRefresh(true);
+    await flushPromises();
+
+    expect(tab.location.href).toBe(ATTACHMENT.downloadUrl);
+  });
+
+  test("with refreshSession a modified click is still left to the browser", () => {
+    const refreshSession: ReturnType<typeof jest.fn<() => Promise<boolean>>> =
+      jest.fn<() => Promise<boolean>>(async (): Promise<boolean> => {
+        return true;
+      });
+
+    render(
+      <EventAttachmentList
+        attachments={[ATTACHMENT]}
+        refreshSession={refreshSession}
+      />,
+    );
+
+    fireEvent.click(screen.getByTitle(ATTACHMENT.name), { metaKey: true });
+
+    expect(lastClickWasPrevented).toBe(false);
+    expect(refreshSession).not.toHaveBeenCalled();
+    expect(windowOpen).not.toHaveBeenCalled();
+  });
+
+  test("the inline variant, used for timeline notes, takes the same refresh", () => {
+    const refreshSession: ReturnType<typeof jest.fn<() => Promise<boolean>>> =
+      jest.fn<() => Promise<boolean>>(async (): Promise<boolean> => {
+        return true;
+      });
+
+    render(
+      <EventAttachmentList
+        attachments={[ATTACHMENT]}
+        variant="inline"
+        showHeader={false}
+        showCount={false}
+        refreshSession={refreshSession}
+      />,
+    );
+
+    fireEvent.click(screen.getByTitle(ATTACHMENT.name));
+
+    expect(lastClickWasPrevented).toBe(true);
+    expect(refreshSession).toHaveBeenCalledTimes(1);
+  });
+});