@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Utils/Monitor/MonitorDestinationUtil.test.ts

@@ -0,0 +1,313 @@
+import Hostname from "../../../Types/API/Hostname";
+import URL from "../../../Types/API/URL";
+import IP from "../../../Types/IP/IP";
+import MonitorType from "../../../Types/Monitor/MonitorType";
+import MonitorDestinationUtil, {
+  ParsedMonitorDestination,
+} from "../../../Utils/Monitor/MonitorDestinationUtil";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * What the dashboard's destination field does with what somebody typed.
+ *
+ * This exists because of a customer who had working monitors on their IPv4
+ * BGP endpoints, added the IPv6 ones, and could not get them to work
+ * Their test address, used verbatim throughout this file, was
+ * 2001:518:2800:9::2.
+ *
+ * The failure was not that IPv6 was rejected. It was that an IPv6 address
+ * with a trailing space — which is what copying one out of a looking glass,
+ * a router config or a terminal gives you — was SILENTLY TRUNCATED to
+ * "2001:518" and saved, with no error shown. The identical IPv4 paste worked,
+ * because "1.1.1.1 " has no colon to split on.
+ *
+ * Every "the customer's address" case below failed before the fix.
+ */
+
+const CUSTOMER_ADDRESS: string = "2001:518:2800:9::2";
+
+function parse(
+  value: string,
+  monitorType: MonitorType,
+): ParsedMonitorDestination {
+  return MonitorDestinationUtil.parse({
+    value: value,
+    monitorType: monitorType,
+  });
+}
+
+const HOST_MONITOR_TYPES: Array<MonitorType> = [
+  MonitorType.IP,
+  MonitorType.Ping,
+  MonitorType.Port,
+];
+
+describe("MonitorDestinationUtil.parse — the customer's IPv6 BGP endpoint", () => {
+  for (const monitorType of HOST_MONITOR_TYPES) {
+    describe(`${monitorType} monitor`, () => {
+      test("keeps the address exactly as typed", () => {
+        const parsed: ParsedMonitorDestination = parse(
+          CUSTOMER_ADDRESS,
+          monitorType,
+        );
+
+        expect(parsed.error).toBeNull();
+        expect(parsed.destination).toBeInstanceOf(IP);
+        expect(parsed.destination?.toString()).toBe(CUSTOMER_ADDRESS);
+      });
+
+      test("a trailing space does not truncate it to its first two groups", () => {
+        /*
+         * THE BUG. "2001:518:2800:9::2 " missed IP.isIP (which does not
+         * trim), fell through to Hostname.fromString, and came back as host
+         * "2001" with port 518. 518 is a legal port, so nothing threw and
+         * the operator was shown no error at all.
+         */
+        const parsed: ParsedMonitorDestination = parse(
+          `${CUSTOMER_ADDRESS} `,
+          monitorType,
+        );
+
+        expect(parsed.error).toBeNull();
+        expect(parsed.destination?.toString()).toBe(CUSTOMER_ADDRESS);
+        expect(parsed.destination?.toString()).not.toBe("2001:518");
+      });
+
+      test("a leading space or a trailing newline is tolerated the same way", () => {
+        expect(
+          parse(` ${CUSTOMER_ADDRESS}`, monitorType).destination?.toString(),
+        ).toBe(CUSTOMER_ADDRESS);
+        expect(
+          parse(`${CUSTOMER_ADDRESS}\n`, monitorType).destination?.toString(),
+        ).toBe(CUSTOMER_ADDRESS);
+      });
+
+      test("the bracketed spelling is accepted and stored bare", () => {
+        /*
+         * "[2001:518:2800:9::2]" is how the address is written inside a URL,
+         * so it is a form people have to hand. It used to produce the
+         * baffling "Hostname [2001 is not in valid format." on Ping/Port.
+         */
+        const parsed: ParsedMonitorDestination = parse(
+          `[${CUSTOMER_ADDRESS}]`,
+          monitorType,
+        );
+
+        expect(parsed.error).toBeNull();
+        expect(parsed.destination?.toString()).toBe(CUSTOMER_ADDRESS);
+      });
+
+      test("the equivalent IPv4 paste keeps behaving exactly as it always did", () => {
+        expect(parse("192.0.2.1", monitorType).destination?.toString()).toBe(
+          "192.0.2.1",
+        );
+        expect(parse("192.0.2.1 ", monitorType).destination?.toString()).toBe(
+          "192.0.2.1",
+        );
+      });
+
+      test("an address that is genuinely malformed is reported, not stored", () => {
+        const parsed: ParsedMonitorDestination = parse(
+          "2001:518:2800:9:::2",
+          monitorType,
+        );
+
+        expect(parsed.destination).toBeUndefined();
+        expect(parsed.error).toBeTruthy();
+      });
+
+      test("an empty field is a missing destination, not a parse failure", () => {
+        expect(parse("   ", monitorType)).toEqual({
+          destination: undefined,
+          error: "Destination is required",
+        });
+      });
+    });
+  }
+
+  describe("every prefix of the address as it is typed", () => {
+    /*
+     * Typing left to right passes through "2001:518:2800:9::", which IS a
+     * real address. The form used to write each parse into the step and
+     * never clear it, so a prefix that parsed could outlive the keystrokes
+     * after it. What matters here is that no prefix EVER parses to something
+     * that is not what was typed.
+     */
+    test("a prefix either fails to parse or parses to itself — never to something else", () => {
+      for (let i: number = 1; i <= CUSTOMER_ADDRESS.length; i++) {
+        const prefix: string = CUSTOMER_ADDRESS.substring(0, i);
+
+        for (const monitorType of HOST_MONITOR_TYPES) {
+          const parsed: ParsedMonitorDestination = parse(prefix, monitorType);
+
+          if (parsed.destination) {
+            expect(parsed.destination.toString()).toBe(prefix);
+          }
+        }
+      }
+    });
+
+    test("the COMPLETE address never parses to 2001:518, however it is spelled", () => {
+      /*
+       * "2001:518" on its own is a legitimate parse of the prefix "2001:518"
+       * — the operator really had typed only that. What must never happen is
+       * the complete address arriving and 2001:518 being what gets stored.
+       */
+      const spellings: Array<string> = [
+        CUSTOMER_ADDRESS,
+        `${CUSTOMER_ADDRESS} `,
+        ` ${CUSTOMER_ADDRESS}`,
+        `${CUSTOMER_ADDRESS}\n`,
+        `\t${CUSTOMER_ADDRESS}\t`,
+        `[${CUSTOMER_ADDRESS}]`,
+        ` [${CUSTOMER_ADDRESS}] `,
+      ];
+
+      for (const spelling of spellings) {
+        for (const monitorType of HOST_MONITOR_TYPES) {
+          expect(parse(spelling, monitorType).destination?.toString()).toBe(
+            CUSTOMER_ADDRESS,
+          );
+        }
+      }
+    });
+  });
+});
+
+describe("MonitorDestinationUtil.parse — hostnames still work", () => {
+  test("a DNS name is a Hostname", () => {
+    const parsed: ParsedMonitorDestination = parse(
+      "rs1.example.net",
+      MonitorType.Ping,
+    );
+
+    expect(parsed.error).toBeNull();
+    expect(parsed.destination).toBeInstanceOf(Hostname);
+    expect(parsed.destination?.toString()).toBe("rs1.example.net");
+  });
+
+  test("a pasted 'host:port' is split, not stored as a host with a colon in its name", () => {
+    /*
+     * `new Hostname("rs1.example.net:179")` would happily store the whole
+     * authority AS THE HOST, and the socket would then go looking for a DNS
+     * name with a colon in it.
+     */
+    const parsed: ParsedMonitorDestination = parse(
+      "rs1.example.net:179",
+      MonitorType.Port,
+    );
+
+    expect(parsed.error).toBeNull();
+    expect((parsed.destination as Hostname).hostname).toBe("rs1.example.net");
+    expect((parsed.destination as Hostname).port?.toNumber()).toBe(179);
+  });
+
+  test("a bracketed IPv6 host WITH a port is split the same way", () => {
+    const parsed: ParsedMonitorDestination = parse(
+      `[${CUSTOMER_ADDRESS}]:179`,
+      MonitorType.Port,
+    );
+
+    expect(parsed.error).toBeNull();
+    expect((parsed.destination as Hostname).port?.toNumber()).toBe(179);
+  });
+
+  test("an IP monitor rejects a DNS name, as it always has", () => {
+    expect(
+      parse("rs1.example.net", MonitorType.IP).destination,
+    ).toBeUndefined();
+  });
+});
+
+describe("MonitorDestinationUtil.parse — URL monitor types", () => {
+  const URL_MONITOR_TYPES: Array<MonitorType> = [
+    MonitorType.Website,
+    MonitorType.API,
+    MonitorType.SSLCertificate,
+  ];
+
+  for (const monitorType of URL_MONITOR_TYPES) {
+    test(`${monitorType}: a bracketed IPv6 URL round-trips`, () => {
+      const parsed: ParsedMonitorDestination = parse(
+        `https://[${CUSTOMER_ADDRESS}]/health`,
+        monitorType,
+      );
+
+      expect(parsed.error).toBeNull();
+      expect(parsed.destination).toBeInstanceOf(URL);
+      expect(parsed.destination?.toString()).toBe(
+        `https://[${CUSTOMER_ADDRESS}]/health`,
+      );
+    });
+
+    test(`${monitorType}: a BARE IPv6 URL is bracketed rather than stored unusable`, () => {
+      /*
+       * "https://2001:518:2800:9::2/" is not a URL — the first colon reads
+       * as the port separator, and every HTTP client rejects it. The field
+       * used to accept it verbatim and the monitor then failed forever.
+       */
+      const parsed: ParsedMonitorDestination = parse(
+        `https://${CUSTOMER_ADDRESS}/`,
+        monitorType,
+      );
+
+      expect(parsed.error).toBeNull();
+      expect(parsed.destination?.toString()).toBe(
+        `https://[${CUSTOMER_ADDRESS}]/`,
+      );
+    });
+
+    test(`${monitorType}: an IPv4 or DNS URL is left byte for byte alone`, () => {
+      expect(
+        parse(
+          "https://example.com:8443/x?y=1",
+          monitorType,
+        ).destination?.toString(),
+      ).toBe("https://example.com:8443/x?y=1");
+      expect(
+        parse("https://192.0.2.1/health", monitorType).destination?.toString(),
+      ).toBe("https://192.0.2.1/health");
+    });
+  }
+});
+
+describe("MonitorDestinationUtil.toUrlWithBracketedIpv6Host", () => {
+  const bracket: (value: string) => string = (value: string): string => {
+    return MonitorDestinationUtil.toUrlWithBracketedIpv6Host(value);
+  };
+
+  test("brackets a bare IPv6 host", () => {
+    expect(bracket(`https://${CUSTOMER_ADDRESS}`)).toBe(
+      `https://[${CUSTOMER_ADDRESS}]`,
+    );
+  });
+
+  test("keeps the path, query and fragment where they were", () => {
+    expect(bracket(`https://${CUSTOMER_ADDRESS}/a/b?c=1#d`)).toBe(
+      `https://[${CUSTOMER_ADDRESS}]/a/b?c=1#d`,
+    );
+  });
+
+  test("does not bracket twice", () => {
+    expect(bracket(`https://[${CUSTOMER_ADDRESS}]/a`)).toBe(
+      `https://[${CUSTOMER_ADDRESS}]/a`,
+    );
+  });
+
+  test("keeps userinfo outside the brackets", () => {
+    expect(bracket(`https://user:token@${CUSTOMER_ADDRESS}/a`)).toBe(
+      `https://user:token@[${CUSTOMER_ADDRESS}]/a`,
+    );
+  });
+
+  test("leaves a DNS or IPv4 URL untouched", () => {
+    expect(bracket("https://example.com:8443/x")).toBe(
+      "https://example.com:8443/x",
+    );
+    expect(bracket("http://192.0.2.1/x")).toBe("http://192.0.2.1/x");
+  });
+
+  test("leaves a host:port that only looks address-ish untouched", () => {
+    expect(bracket("https://localhost:3000")).toBe("https://localhost:3000");
+  });
+});

package/Tests/Utils/Monitor/MonitoringIntervalUtil.test.ts

@@ -0,0 +1,304 @@
+import MonitoringIntervalUtil, {
+  MonitoringIntervalNormalization,
+  MonitoringIntervalNormalizationStatus,
+} from "../../../Utils/Monitor/MonitoringIntervalUtil";
+import CronTab from "../../../Utils/CronTab";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * WHAT THIS FILE IS DEFENDING
+ *
+ * Monitor.monitoringInterval is free-text and was never validated. Rows
+ * accumulated holding a human cadence ("5m", "Every 5 minutes") where a cron
+ * expression was expected. cron-parser threw on those, the claim query
+ * caught the throw and fell back to "one minute from now", and a monitor
+ * configured for five minutes was probed every ~75 seconds — four times the
+ * requested rate, silently, for as long as the row existed.
+ *
+ * 103 monitors across 10 projects were in that state. The ten distinct bad
+ * values below are the REAL production census, not invented examples, and
+ * every one of them is asserted individually.
+ */
+
+function normalize(value: string | null | undefined): string | null {
+  return MonitoringIntervalUtil.toCronOrNull(value);
+}
+
+describe("MonitoringIntervalUtil", () => {
+  describe("the production census — every bad value found in the wild", () => {
+    /*
+     * SELECT "monitoringInterval", count(*) FROM "Monitor"
+     *   WHERE "deletedAt" IS NULL AND "monitoringInterval" is not cron
+     * 103 rows, 10 distinct values, 10 projects.
+     */
+    const PRODUCTION_VALUES: Array<[string, string, number]> = [
+      ["Every 5 minutes", "*/5 * * * *", 35],
+      ["5m", "*/5 * * * *", 19],
+      ["1 minute", "* * * * *", 18],
+      ["Every 5 Minutes", "*/5 * * * *", 14],
+      ["Every 1 minute", "* * * * *", 6],
+      ["Every 2 minutes", "*/2 * * * *", 4],
+      ["5 minutes", "*/5 * * * *", 3],
+      ["1 day", "0 0 * * *", 2],
+      ["every-1-min", "* * * * *", 1],
+      ["Every Five Minutes", "*/5 * * * *", 1],
+    ];
+
+    test.each(PRODUCTION_VALUES)(
+      "reads %j as %j (%i monitors in production)",
+      (input: string, expectedCron: string) => {
+        expect(normalize(input)).toBe(expectedCron);
+      },
+    );
+
+    test("every production value now yields a parseable cron", () => {
+      for (const [input] of PRODUCTION_VALUES) {
+        const cron: string | null = normalize(input);
+
+        /*
+         * "Every Five Minutes" spells its number out, which the duration
+         * grammar cannot read. It is covered by the exact-label table; if
+         * that entry is ever dropped this assertion is what catches it.
+         */
+        expect(cron).not.toBeNull();
+        expect(CronTab.isValid(cron as string)).toBe(true);
+      }
+    });
+
+    test("the customer's value is five minutes apart, not one", () => {
+      /*
+       * The regression in one line: "5m" must not mean "every minute".
+       */
+      expect(normalize("5m")).toBe("*/5 * * * *");
+      expect(normalize("5m")).not.toBe("* * * * *");
+    });
+  });
+
+  describe("valid cron is returned untouched", () => {
+    const VALID: Array<string> = [
+      "* * * * *",
+      "*/2 * * * *",
+      "*/5 * * * *",
+      "*/10 * * * *",
+      "*/15 * * * *",
+      "*/30 * * * *",
+      "0 * * * *",
+      "0 */6 * * *",
+      "0 0 * * *",
+      "0 0 * * 0",
+      "0 9 * * 1",
+      "3-59/5 * * * *",
+      "0,15,30,45 * * * *",
+    ];
+
+    test.each(VALID)("%j passes through byte-identical", (cron: string) => {
+      const result: MonitoringIntervalNormalization =
+        MonitoringIntervalUtil.normalize(cron);
+
+      expect(result.status).toBe(
+        MonitoringIntervalNormalizationStatus.AlreadyCanonical,
+      );
+      expect(result.cron).toBe(cron);
+    });
+
+    test("cron-parser shortcuts are never REWRITTEN into something else", () => {
+      /*
+       * "@hourly" is a deliberate seam between the two parsers. The
+       * isomorphic validator here is a hand-rolled 5-field check and does
+       * not know it; cron-parser, which actually schedules the probe, does.
+       *
+       * What matters is that this util never GUESSES: it reports
+       * Unrecognized with a null cron rather than rewriting "@hourly" into
+       * "0 * * * *". The server validator's cron-parser fallback is what
+       * accepts it on write, and resolveNextPingAt's raw-parse-first order
+       * is what honours it at runtime — both covered in their own suites.
+       * If this util ever started rewriting it, a stored value would change
+       * under the customer for no behavioural gain.
+       */
+      const result: MonitoringIntervalNormalization =
+        MonitoringIntervalUtil.normalize("@hourly");
+
+      expect(result.status).toBe(
+        MonitoringIntervalNormalizationStatus.Unrecognized,
+      );
+      expect(result.cron).toBeNull();
+    });
+  });
+
+  describe("empty is a legitimate state, never an error", () => {
+    /*
+     * ~4,177 production rows are NULL or blank. A Manual monitor is never
+     * probed; treating that as invalid would break every one of them.
+     */
+    test.each([null, undefined, "", "   ", "\t\n"])(
+      "%j is Empty with a null cron",
+      (value: string | null | undefined) => {
+        const result: MonitoringIntervalNormalization =
+          MonitoringIntervalUtil.normalize(value);
+
+        expect(result.status).toBe(MonitoringIntervalNormalizationStatus.Empty);
+        expect(result.cron).toBeNull();
+      },
+    );
+  });
+
+  describe("label tolerance", () => {
+    test("is case-insensitive", () => {
+      expect(normalize("EVERY 5 MINUTES")).toBe("*/5 * * * *");
+      expect(normalize("every 5 minutes")).toBe("*/5 * * * *");
+      expect(normalize("Every 5 Minutes")).toBe("*/5 * * * *");
+    });
+
+    test("collapses runs of whitespace, including a non-breaking space", () => {
+      expect(normalize("Every  5   minutes")).toBe("*/5 * * * *");
+      expect(normalize("  Every 5 minutes  ")).toBe("*/5 * * * *");
+      // U+00A0 survives a copy-paste out of rendered docs.
+      expect(normalize("Every 5 minutes")).toBe("*/5 * * * *");
+    });
+
+    test("strips wrapping quotes and a trailing period", () => {
+      expect(normalize('"Every 5 minutes"')).toBe("*/5 * * * *");
+      expect(normalize("'5m'")).toBe("*/5 * * * *");
+      expect(normalize("Every 5 minutes.")).toBe("*/5 * * * *");
+    });
+
+    test("reads hyphenated and underscored forms", () => {
+      expect(normalize("every-1-min")).toBe("* * * * *");
+      expect(normalize("every_5_minutes")).toBe("*/5 * * * *");
+    });
+
+    test("covers every label the shared preset list offers", () => {
+      /*
+       * The table is built by iterating CronTab.PRESETS, so a preset added
+       * there is understood here without anyone editing the util. This
+       * asserts that wiring rather than the individual labels.
+       */
+      for (const preset of CronTab.PRESETS) {
+        expect(normalize(preset.label)).toBe(preset.value);
+      }
+    });
+  });
+
+  describe("duration grammar", () => {
+    test.each([
+      ["1m", "* * * * *"],
+      ["1 min", "* * * * *"],
+      ["minutely", "* * * * *"],
+      ["2m", "*/2 * * * *"],
+      ["10 mins", "*/10 * * * *"],
+      ["15 minutes", "*/15 * * * *"],
+      ["30m", "*/30 * * * *"],
+      ["60m", "0 * * * *"],
+      ["1h", "0 * * * *"],
+      ["hourly", "0 * * * *"],
+      ["2 hours", "0 */2 * * *"],
+      ["6h", "0 */6 * * *"],
+      ["12 hrs", "0 */12 * * *"],
+      ["24h", "0 0 * * *"],
+      ["1d", "0 0 * * *"],
+      ["daily", "0 0 * * *"],
+      ["1 week", "0 0 * * 0"],
+      ["weekly", "0 0 * * 0"],
+    ])("reads %j as %j", (input: string, expected: string) => {
+      expect(normalize(input)).toBe(expected);
+    });
+  });
+
+  describe("refuses to store a lie", () => {
+    /*
+     * "*_/7 * * * *" fires at :00, :07 ... :56 and then :00 — a four-minute
+     * gap at every hour wrap. It is NOT "every 7 minutes", so normalizing
+     * "every 7 minutes" to it would store something false. Better to refuse
+     * and let the caller write the cron they actually mean.
+     */
+    test.each([
+      "7m",
+      "every 7 minutes",
+      "13 minutes",
+      "5 hours",
+      "7h",
+      "2 days",
+      "3 weeks",
+    ])(
+      "%j is Unrecognized rather than silently approximated",
+      (input: string) => {
+        const result: MonitoringIntervalNormalization =
+          MonitoringIntervalUtil.normalize(input);
+
+        expect(result.status).toBe(
+          MonitoringIntervalNormalizationStatus.Unrecognized,
+        );
+        expect(result.cron).toBeNull();
+      },
+    );
+
+    test("sub-minute cadences are not invented", () => {
+      /*
+       * The claim loop ticks once a minute, so a per-second cadence is a
+       * promise the probe fleet cannot keep.
+       */
+      for (const input of ["30s", "1s", "10 seconds", "1 sec"]) {
+        expect(normalize(input)).toBeNull();
+      }
+    });
+  });
+
+  describe("genuine nonsense stays Unrecognized", () => {
+    test.each([
+      "banana",
+      "asap",
+      "not a cron",
+      "soon",
+      "-1m",
+      "0m",
+      "every",
+      "minutes",
+    ])("%j", (input: string) => {
+      expect(normalize(input)).toBeNull();
+    });
+  });
+
+  describe("totality", () => {
+    /*
+     * It runs in a write hook, on the scheduler hot path and inside a
+     * migration. A throw in any of those is worse than a null.
+     */
+    test("never throws, whatever it is handed", () => {
+      const hostile: Array<unknown> = [
+        null,
+        undefined,
+        "",
+        "🙂",
+        "*".repeat(5000),
+        "{{ variable }}",
+        "; DROP TABLE Monitor; --",
+        "",
+        12345,
+        {},
+        [],
+      ];
+
+      for (const value of hostile) {
+        expect(() => {
+          return MonitoringIntervalUtil.normalize(value as string);
+        }).not.toThrow();
+      }
+    });
+
+    test("is idempotent — normalizing its own output changes nothing", () => {
+      const inputs: Array<string> = [
+        "5m",
+        "Every 5 minutes",
+        "1 day",
+        "every-1-min",
+        "*/5 * * * *",
+      ];
+
+      for (const input of inputs) {
+        const once: string | null = normalize(input);
+        expect(once).not.toBeNull();
+        expect(normalize(once)).toBe(once);
+      }
+    });
+  });
+});